Okta (OKTA) 10-K2022 FY Annual report

(Exact name of Registrant as specified in its charter)

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

This Annual Report on Form 10-K contains "forward-looking statements" within the meaning of the “safe harbor” provisions of the Private Securities Litigation Reform Act of 1995, including but not limited to, statements regarding our financial outlook, product development, business strategy, plans, market trends, opportunities, positioning, and the anticipated impact on our business of the COVID-19 pandemic, related public health measures and any associated economic downturn. These forward-looking statements are made as of the date they were first issued and were based on current expectations, estimates, forecasts and projections as well as the beliefs and assumptions of management. Words such as “expect,” “anticipate,” “should,” “believe,” “hope,” “target,” “project,” “goals,” “estimate,” “potential,” “predict,” “may,” “will,” “might,” “could,” “intend,” “shall” and variations of these terms or the negative of these terms and similar expressions are intended to identify these forward-looking statements, although not all forward-looking statements include these identifying words. The forward-looking statements are contained principally in “Management’s Discussion and Analysis of Financial Condition and Result of Operations” and “Risk Factors."

Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

Forward-looking statements are subject to a number of risks and uncertainties, many of which involve factors or circumstances that are beyond our control. Our actual results could differ materially from those stated or implied in forward-looking statements due to a number of factors, including but not limited to, risks detailed in “Risk Factors” in this Annual Report on Form 10-K as well as other documents that may be filed by us from time to time with the Securities and Exchange Commission. Moreover, we operate in a very competitive and rapidly changing environment. New risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties and assumptions, the forward-looking events and circumstances discussed in this Annual Report on Form 10-K may not occur and actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements.

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that the future results, levels of activity, performance or events and circumstances reflected in the forward-looking statements will be achieved or occur. Moreover, except as required by law, neither we nor any other person assumes responsibility for the accuracy and completeness of the forward-looking statements. We undertake no obligation to update publicly any forward-looking statements for any reason after the date of this Annual Report on Form 10-K to conform these statements to actual results or to changes in our expectations.

Part I

Item 1. Business

Okta is the leading independent identity provider. Our vision is to free anyone to safely use any technology, and we believe identity is the key to making that happen. Our mission is to bring simple and secure digital access to people and organizations everywhere. The Okta Identity Cloud is powered by our category-defining platform that enables our customers to securely connect the right people to the right technologies and services at the right time.

The Okta Identity Cloud helps organizations effectively harness the power of cloud, mobile and web technologies by securing users and connecting them with the applications and technology they use. We designed the Okta Identity Cloud to provide organizations an integrated approach to managing and securing every identity in an organization. Every day, thousands of organizations and millions of people use Okta to securely access a wide range of cloud, mobile and web applications, on-premises servers, application program interfaces ("APIs"), IT infrastructure providers and services from a multitude of devices. Developers leverage our platform to securely and efficiently embed identity into the software they build, allowing them to focus on their core mission. Employees and contractors sign into the Okta Identity Cloud to seamlessly and securely access the applications they need to do their most important work. Organizations use our platform to collaborate with their partners, and to provide their customers with more modern and secure experiences in the cloud and via mobile devices. As we add new customers, users, developers and integrations to our platform, our business, customers, partners and users benefit from powerful network effects that increase the value and security of the Okta Identity Cloud.

The acceleration of digital transformations, cloud modernization and evolving security threat landscape and changing consumer expectations to simple, secure digital experiences are driving a shift in how organizations manage consumer identities on the internet. Organizations are building secure consumer-facing applications and are turning to identity to optimize seamless and private user experiences. Our approach provides organizations with the scale, efficiency and security they need to build customer-facing applications.

Given the growth trends in the number of applications and cloud adoption, and the movement to remote workforces, identity is becoming the most critical layer of an organization’s security. As organizations shift from network-based security models to a Zero Trust security model focusing on adaptive and context-aware controls, identity has become the most reliable way to manage user access and protect digital assets. Our approach to identity allows our customers to simplify and efficiently scale their security infrastructures across internal IT systems and external customer-facing applications.

We designed the Okta Identity Cloud to provide organizations an integrated approach to managing and securing all of their identities. Our platform allows our customers to easily provision their customers, employees, contractors, and partners, enabling any user to connect to any device, cloud or application, all with a simple, intuitive and consumer-like user experience.

As of January 31, 2022, more than 15,000 customers across nearly every industry used the Okta Identity Cloud to secure and manage identities around the world. Our customers consist of leading global organizations ranging from the largest enterprises, to small and medium-sized businesses, universities, non-profits and government agencies. We partner with leading application, infrastructure and security vendors, such as Amazon Web Services, Cisco, CrowdStrike, Google Cloud, Microsoft, Netskope, Proofpoint, Salesforce, ServiceNow, VMware and Workday. We had over 7,000 integrations with cloud, mobile and web applications and IT infrastructure providers as of January 31, 2022, which while not directly correlated to revenue, shows the breadth and acceptance of our platform.

On May 3, 2021, we acquired Auth0, Inc. ("Auth0"). Auth0's cloud-native identity and access management solution provides application builders with the building blocks they need to add authentication and authorization to their applications, in a scalable and easy-to-integrate way.

We employ a Software-as-a-Service ("SaaS") business model, and generate revenue primarily by selling multi-year subscriptions to our cloud-based offerings. We focus on acquiring and retaining our customers and increasing their spending with us through expanding the number of users who access the Okta Identity Cloud and up-selling additional products, including Auth0. We sell our products directly through our field and inside sales

teams, as well as indirectly through our network of channel partners, including resellers, system integrators and other distribution partners.

The Okta Identity Cloud

The Okta Identity Cloud is an independent and neutral cloud-based identity solution that allows our customers to integrate with nearly any application, service or cloud that they choose through our secure, reliable and scalable platform and cloud infrastructure. Our technological neutrality allows our customers to easily adopt the best technologies, and our platform is designed to securely connect users to the technology that they choose. We prioritize the compatibility of the Okta Identity Cloud with public clouds, on-premises infrastructures and hybrid clouds. Our customers use the Okta Identity Cloud to secure their workforces, to create solutions that make their partner networks more collaborative, and to provide more seamless and secure experiences for their customers or end users, which combined with our open approach, enables our customers to future-proof their environments.

The Okta Identity Cloud can be used as the central system for an organization’s connectivity, access, authentication and identity lifecycle management needs spanning all of its users, technology and applications.

We enable our customers to easily deploy, manage and secure applications and devices, and to provision and support users across their IT environments, with a simple, intuitive, consumer-like user experience. Developers are similarly able to leverage a robust set of tools through the platform to quickly build custom cloud, mobile and web application experiences that leverage the breadth and depth of capabilities within the Okta Identity Cloud. Once deployed, we enable administrators to enforce contextual access management decisions based on conditions such as user identity, device, location, application identity, IP reputation and time of day.

Workforce Identity Cloud

Okta's proprietary cell architecture includes redundant, active-active availability zones with cross-continental disaster recovery centers, real-time database replication and geo-distributed storage. If one of our systems goes down, another is quickly promoted. Our architecture is designed to scale both vertically by increasing the size of the application tiers and horizontally by adding new geo-distributed cells.

The Okta Identity Cloud is monitored not only at the infrastructure level but also at the application and third-party integration level. Synthetic transaction monitoring allows our technical operations team to detect and resolve issues proactively.

Our sales organization is structured to address the specific needs of each segment of our target market. Our sales team is divided by geography, customer size and industry vertical. Our direct sales force is supported by our sales engineers, security team, cloud architects, professional services team and other technical resources.

We benefit from an expansive partner ecosystem that helps drive additional sales. Nearly all of the leading cloud application providers are our partners, and many of them drive further customer acquisition for us through co-selling arrangements, building our offerings directly into their products, and product demonstrations running on the Okta Identity Cloud. We also partner with several of the large technology companies that are driving the movement to the cloud. In addition to these technology partners, we leverage our channel partners, including system integrators, traditional VARs and Government VARs, to broaden the range of customers we reach.

Our most valuable marketing features our customers and their successes, and is informed by a deeply data-driven approach, giving us insights into the efficacy of our efforts. Our marketing efforts focus on promoting our industry-leading identity platform, establishing our brand, generating awareness, creating sales leads and cultivating the Okta Community.

A centerpiece of our marketing strategy is our annual customer conference, Oktane, that features customers sharing their success stories, new product and feature announcements and hands-on product labs. We also host a number of other events, such as Okta Showcase, a key event for product and feature announcements, where we engage with both existing customers and new prospects, as well as deliver product training.

As of January 31, 2022, we had twenty-eight issued patents in the United States, which expire between 2030 and 2039 and cover various aspects of our products. In addition, as of such date, we also had nine issued patents in Australia which expire between 2033 and 2037, six issued patents in New Zealand which expire between 2034 and 2037, and nine issued European patents which have each been validated in Germany, France and Great Britain, with some also validated in Switzerland, Denmark, Spain, the Netherlands, Norway and Sweden, and expire between 2033 and 2037.

We have registered “Okta” and "Auth0" as trademarks in many jurisdictions throughout the world to protect our brands. We also have filed other trademark applications pending in various jurisdictions throughout the world. We also have registered other trademarks in the United States including "Okta Your Cloud, Covered," "Enterprise Identity, Delivered," "Work Outside the Perimeter," "Oktane" and "Never Build Auth Again."

We are the registered holder of a variety of domestic and international domain names that include “Okta,” "Auth0" and similar variations.

In addition to the protection provided by our intellectual property rights, we enter into confidentiality and proprietary rights or similar agreements with our employees, consultants and contractors. Our employees, consultants and contractors are also subject to invention assignment agreements. We further control the use of our proprietary technology and intellectual property through provisions in both general and product-specific terms of use.

Additional information regarding certain risks related to our intellectual property is included in Part I, Item 1A “Risk Factors” of this Annual Report on Form 10-K.

We compete with both cloud-based and on-premise enterprise application software providers. Our competitors vary in size and in the breadth and scope of the products and services offered. However, certain of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, longer operating histories, greater resources to make strategic acquisitions and greater name recognition than we do. Our principal competitor is Microsoft.

Due to the flexibility and breadth of our platform, we can and often do co-exist alongside our competitors’ products within our customer base.

Principal competitive factors in our markets include flexibility, independence, product capabilities, total cost of ownership, time to value, scalability, user experience, number of pre-built integrations, customer satisfaction, global reach and ease of integration, management and use. We believe our product strategy, platform architecture,

technology and independence as well as our company culture allow us to compete favorably on each of these factors.

We expect competition to increase as other established and emerging companies enter our markets, as customer requirements evolve, and as new products and technologies are introduced. We expect this to be particularly true as we are a cloud-based offering, and our competitors may also seek to acquire new offerings or repurpose their existing offerings to provide identity management solutions with subscription models. With the continuing merger and acquisition activity in the technology industry, particularly transactions involving security or identity and access management technologies, there is a greater likelihood that we will compete with other large technology companies in the future in both the workforce identity and customer identity markets.

As of January 31, 2022, we had 5,030 employees, of which approximately 74% were in the United States and 26% were in our international locations. We have not experienced any work stoppages, and we consider our relations with our employees to be good. Our employee engagement program helps us understand employee sentiment on a wide range of topics throughout the employee lifecycle, providing insights that inform our decisions about company initiatives, employee programs, talent risks, management opportunities and more. In fiscal 2022, 83% of our eligible employees participated in our annual employee engagement survey.

We encourage you to review the “Diversity, Inclusion and Belonging,” “Responsibility,” “Careers” and “Okta for Good” pages of our website at www.okta.com for more detailed information regarding our human capital programs and initiatives. Additional information on our diversity, inclusion and belonging strategy, diversity metrics and programs can be found in our most recent State of Inclusion at Okta annual report located on our website at www.okta.com/state-of-inclusion-at-okta, and additional information on our compensation, benefits and wellness programs is available on our Total Rewards website at rewards.okta.com. The information contained on, or that can be accessed through, our website is not incorporated by reference into this Annual Report on Form 10-K.

“Empower our people” is one of our core values and in fiscal 2022, we introduced our “People First” philosophy in which culture, career growth, competitive rewards, flexible work and purpose come together to create a shared sense of ownership in achieving our company vision. As we enter our next phase of growth, bolstered by the addition of Auth0 and its employees, we want every employee to feel ownership of Okta.

Through Okta for Good, which is a part of our company and not a separate legal entity, we donate and discount access to our service for non-profit organizations, who use the Okta Identity Cloud to make their teams more efficient, allowing them to focus on making a meaningful impact in the world. Our employee volunteer program enables global team members to donate time to support charitable organizations worldwide.

Risk Factor Summary

This risk factor summary contains a high-level summary of risks associated with our business. It does not contain all of the information that may be important to you, and you should read this risk factor summary together with the more detailed discussion of risks and uncertainties set forth following this summary. A summary of our risks includes, but is not limited to, the following:

Risks Related to Our Business and Industry

The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, including vaccine mandates, and their impact on the global economy, our customers, employees and vendors. While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of emerging variants of COVID-19. This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.

As a result of the COVID-19 pandemic, for most of fiscal 2021, we temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions. We shifted our customer, employee and industry events, including our annual user conferences Oktane20 Live and Oktane21 Live, to virtual-only formats. In fiscal 2022, as the administration of vaccines increased, we reopened our offices to partial capacity, allowing our employees to voluntarily return, and in fiscal 2023, we are shifting to hybrid in-person and virtual sales formats and experiences for future annual user conferences. The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings. It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.

Our operations have been and may continue to be affected by a range of external factors related to the COVID-19 pandemic that are not within our control. For example, many cities, counties, states and countries imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19. If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy. Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.

Adverse general economic and market conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.

Our revenue, results of operations and cash flows depend on the overall demand for our products. Concerns about the COVID-19 pandemic, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S. economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers. These economic conditions can occur abruptly. Prolonged economic slowdowns may result in customers requesting us to renegotiate existing contracts on less advantageous terms to us than those currently in place or defaulting on payments due on existing contracts or not renewing at the end of the contract term.

either of which may harm our revenue, profitability and results of operations. We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict. In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim. As a result, if economic growth in countries where we do business slows or if such countries experience further economic recession, it could harm our business, revenue, results of operations and cash flows.

We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.

Much of our growth has occurred in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, including the risks and uncertainties described in this document. Additionally, the sales cycle for the evaluation and implementation of our platform, which typically extends for multiple months for enterprise deals, may also cause us to experience a delay between increasing operating expenses and the generation of corresponding revenue, if any. Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated revenue that we do not receive as a result of delays arising from these factors, and our results of operations in future reporting periods may be below the expectations of investors. If we do not address these risks successfully, our results of operations could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

We have experienced rapid growth in recent periods, and our recent growth rates may not be indicative of our future growth. As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.

From fiscal 2020 to fiscal 2021, our revenue grew from $586.1 million to $835.4 million, an increase of 43%, and from fiscal 2021 to fiscal 2022, our revenue grew from $835.4 million to $1,300.2 million, an increase of 56%. In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all. We believe our revenue growth depends on a number of factors, such as macroeconomic conditions and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:

If we are unable to accomplish any of these tasks, our revenue growth will be harmed. We also expect our operating expenses to increase in future periods, and if our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

We have a history of losses, and we expect to incur losses for the foreseeable future.

If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources. For example, our headcount has grown from 2,806 employees as of January 31, 2021 to 5,030 employees as of January 31, 2022. We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports. Finally, our organizational structure is becoming more complex as we improve our operational, financial and management controls as well as our reporting systems and procedures. We will require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas without undermining our culture of rapid innovation, teamwork and attention to customer success, which has been central to our growth so far. If we fail to manage our anticipated growth and change in a manner that preserves the key aspects of our corporate culture, the quality of our platform may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.

We have established international offices in the Americas, Asia-Pacific and Europe, and we plan to continue to expand our international operations in the future. Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, marketing and sales, administrative, financial and other resources. If we are unable to manage our continued growth successfully, our business and results of operations could suffer.

In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction. As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of ISVs, system integrators and other channel partners, to provide personalized account management and customer service. If we are not able to continue to provide high levels of customer service, our reputation, as well as our business, results of operations and financial condition, could be harmed.

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

In addition, some of our larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products, including through selling at zero or negative margins, product bundling or closed technology platforms. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. These larger competitors often have broader product lines and market focus and as a result are not as susceptible to downturns in a particular market. Our competitors may also seek to acquire new offerings or repurpose their existing offerings to provide identity solutions with subscription models. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation. New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our products. In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with systems integrators, third-party consulting firms or other parties. Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete. Furthermore, organizations may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our products. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share. Any failure to meet and address these factors could harm our business, results of operations and financial condition.

If we are unable to attract new customers, sell additional products to our existing customers or develop new products and enhancements to our products that achieve market acceptance, our revenue growth and profitability will be harmed.

In addition, our ability to attract new customers and increase revenue from existing customers depends in large part on our ability to enhance and improve our existing products and to introduce compelling new products that reflect the changing nature of our markets. The success of any enhancement to our products depends on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with existing technologies and our platform and overall market acceptance. If we are unable to successfully develop new products, enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.

Further, to grow our business, we must convince developers to adopt and build their applications using our APIs and products. We believe that these developer-built applications facilitate greater usage and customization of our products. If these developers stop developing on or supporting our platform, we will lose the benefit of network effects that have contributed to the growth in our number of customers, and our business (including the performance levels of our products), results of operations and financial condition could be harmed.

Our business depends on our customers renewing their subscriptions and purchasing additional licenses or subscriptions from us. Any material decline in our Dollar-Based Net Retention Rate would harm our future results of operations.

To continue to grow our business, it is important that our customers renew their subscriptions when existing contract terms expire and that we expand our commercial relationships with our existing customers. Our customers have no obligation to renew their subscriptions, and our customers may decide not to renew their subscriptions with a similar contract period, at the same prices and terms or with the same or a greater number of users. We have experienced significant growth in the number of users of our platform, but we do not know whether we will continue to achieve similar user growth rates in the future. In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates. Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings. If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations. Furthermore, if our contractual subscription terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue. If our sales of new or recurring subscriptions and software-related support service contracts decline from existing customers, our revenue and revenue growth may decline, and our business will suffer.

Customer growth could fall below expectations.

We have experienced significant growth in the number of our customers in recent periods. As our customer base continues to grow and as we increase our focus on sales to the world’s largest organizations, we do not expect customer growth to continue at the same pace as it has previously. These factors could cause customer growth to fall below analyst or investor expectations. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

Our quarterly results of operations fluctuate from quarter to quarter as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

Any one or more of the factors above may result in significant fluctuations in our results of operations. You should not rely on our past results as an indicator of our future performance.

The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions. If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform. This is particularly true as we further expand and diversify our capabilities. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. If we elect not to or are unable to develop products internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations. Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that could allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated. In addition, we have limited experience in acquiring other businesses. If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target. Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment, which could harm our results of operations.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments. All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer. For further risks related to our acquisition of Auth0, please see below under “Risks Related to the Acquisition of Auth0.”

Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

Our international revenue was 16% and 20% of our total revenue in fiscal 2021 and fiscal 2022, respectively. Any international expansion efforts that we may undertake may not be successful. In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States. These risks include, among other things:

We have not engaged in currency hedging activities to limit risk of exchange rate fluctuations. Changes in exchange rates affect our costs and earnings, and may also affect the book value of our assets located outside the United States and the amount of our stockholders’ equity.

We have limited experience in marketing, selling and supporting our platform abroad. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.

If we fail to adapt to rapid technological change, our ability to remain competitive could be impaired.

The industry in which we compete is characterized by rapid technological change, frequent introductions of new products and evolving industry standards. Our ability to attract new customers and increase revenue from existing customers will depend in significant part on our ability to anticipate industry standards and trends and continue to enhance existing products or introduce or acquire new products on a timely basis to keep pace with technological developments. The success of any enhancement or new product depends on several factors, including the timely completion and market acceptance of the enhancement or new product. Any new product we develop or acquire might not be introduced in a timely or cost-effective manner and might not achieve the broad market acceptance necessary to generate significant revenue. If any of our competitors implements new technologies before we are able to implement them, those competitors may be able to provide more effective products than ours at lower prices. Any delay or failure in the introduction of new or enhanced products could harm our business, results of operations and financial condition.

Our financial results may fluctuate due to increasing variability in our sales cycles.

We plan our expenses based on certain assumptions about the length and variability of our sales cycle. These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers. As we continue to focus on sales to larger organizations and in light of the current COVID-19 environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results. Other factors that may influence the length and variability of our sales cycle include, among other things:

To grow our business, we anticipate that we will continue to depend on relationships with third parties, such as channel partners. Identifying partners, and negotiating and documenting relationships with them, requires significant time and resources. Our competitors may be effective in causing third parties to favor their products or services over subscriptions to our platform. In addition, acquisitions of such partners by our competitors could result in a decrease in the number of our current and potential customers, as these partners may no longer facilitate the adoption of our applications by potential customers. Further, some of our partners are or may become competitive with certain of our products and may elect to no longer integrate with our platform. If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations may suffer. Even if we are successful, we cannot ensure that these relationships will result in increased customer usage of our applications or increased revenue.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our products will depend to a significant extent on our ability to expand our marketing and sales operations. We plan to continue expanding our direct sales force and engaging additional channel partners, both domestically and internationally. This expansion will require us to invest significant financial and other resources. Our business will be harmed if our

Our business depends upon the successful implementation of our products by our customers. Increasingly, we, as well as our customers, rely on our network of partners to deliver implementation services, and there may not be enough qualified implementation partners available to meet customer demand. Various factors may cause implementations to be delayed, inefficient or otherwise unsuccessful. For example, changes in the functional requirements of our customers, delays in timeline, or deviation from recommended best practices may occur during the course of an implementation project. As a result of these and other risks, we or our customers may incur significant implementation costs in connection with the purchase, implementation and enablement of our products. Some customer implementations may take longer than planned or fail to meet our customers’ expectations, which may delay our ability to sell additional products or result in customers canceling or failing to renew their subscriptions before our products have been fully implemented. Unsuccessful, lengthy, or costly customer implementation and integration projects could result in claims from customers, harm to our reputation, and opportunities for competitors to displace our products, each of which could have an adverse effect on our business and results of operations.

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices. In the past, our efforts to build our brand have involved significant expenses. Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could suffer.

We may not set optimal prices for our products.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product. We expect that we may need to change our pricing in future periods and potentially in response to COVID-19 pricing pressures. Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing. As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally. In addition, if our mix of products sold changes, then we may need to, or choose to, revise our pricing. As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations and financial condition.

Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all. If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

We are subject to numerous obligations in our contracts with our customers and partners. Despite the procedures, systems and internal controls we have implemented to comply with our contracts, we may breach these commitments, whether through a weakness in these procedures, systems and internal controls, negligence or the willful act of an employee or contractor. Our insurance policies, including our errors and omissions insurance, may be inadequate to compensate us for the potentially significant losses that may result from claims arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters or otherwise. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all

claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

The ongoing integration following the acquisition of Auth0 (the “Acquisition”) could cause disruptions to our business or business relationships, which could have an adverse impact on results of operations. Parties with which we have business relationships may experience uncertainty as to the future of such relationships and may delay or defer certain business decisions, seek alternative relationships with third parties or seek to alter their present business relationships with us. Parties with whom we otherwise may have sought to establish business relationships may seek alternative relationships with third parties.

The ongoing integration of Auth0 may place a significant burden on our management and internal resources. The diversion of management’s attention away from day-to-day business concerns and any difficulties encountered in the integration process could adversely affect our financial results.

We have incurred and expect to continue to incur significant costs, expenses and fees for professional services and other transaction costs in connection with the Acquisition. We may also incur unanticipated costs in the integration of Auth0’s business with our business. The substantial majority of these costs will be non-recurring expenses relating to the Acquisition. We also could be subject to litigation related to the Acquisition, which could result in significant costs and expenses.

Prior to the consummation of the Acquisition, we and Auth0 operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits. The ongoing integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven. If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized. Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated. Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition:

In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.

We may incur significant, non‑recurring costs in connection with the Acquisition and integrating the operations of Okta and Auth0, including costs to maintain employee morale and to retain key employees. Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the long term or at all.

Purchase price accounting in connection with our Acquisition requires estimates that may be subject to change and could impact our consolidated financial statements and future results of operations and financial position.

Pursuant to the acquisition method of accounting, the purchase price we paid for Auth0 has been allocated to the underlying Auth0 tangible and intangible assets acquired and liabilities assumed based on their respective fair market values with any excess purchase price allocated to goodwill. The acquisition method of accounting is dependent upon certain valuations and other studies that are preliminary. Accordingly, the purchase price allocation as of the Acquisition date is preliminary. We currently anticipate that all the information needed to identify and measure values assigned to the assets acquired and liabilities assumed will be obtained and finalized during the one‑year measurement period following the date of completion of the Acquisition. Differences between these preliminary estimates and the final acquisition accounting may occur, and these differences could have a material impact on the consolidated financial statements and the combined company’s future results of operations and financial position.

Auth0 may have liabilities that are not known to us.

Auth0 may have liabilities that we failed, or were unable, to discover, or that we underestimated, in the course of performing our due diligence investigations of Auth0’s business and we, as the successor owner of such acquired company, might be responsible for those liabilities. Such potential liabilities could include employment-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties. We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we assumed upon consummation of the Acquisition. We may learn additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws. Any such liabilities, individually or in the aggregate, could have a material adverse effect on our business, results of operations and financial condition.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

integrated into our infrastructure. If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls. We may also be unable to effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology.

Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise harm our business, results of operations and financial condition.

An application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and personal data. If a breach of customer data on our platform were to occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data or systems was disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation. Because techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures. Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.

In addition, security breaches impacting our platform could result in a risk of loss or unauthorized disclosure of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data. Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations. Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses. Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us

to liability and cause us financial harm. For example, in December 2021, a third party reported a remote code execution vulnerability in the Java logging library known as “log4j” that affected many systems worldwide. We have reviewed the use of this library within our software product portfolio and in our IT environment and have taken steps to mitigate the vulnerability. There is no guarantee that our preventative and mitigation actions with respect to this vulnerability and others like it will fully eliminate the risk of a malicious compromise of our or our customers’ systems.

Third parties may attempt to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lock outs, and, ultimately, harm to our future business prospects and revenue. We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform. We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features do not ensure their compliance and may not be effective against all potential privacy or related regulatory concerns.

Many jurisdictions have enacted or are considering enacting or revising privacy and/or data security legislation, including laws and regulations applying to the collection, use, storage, transfer, disclosure and/or processing of personal data. The costs of compliance with, and other burdens imposed by, such laws and regulations that are applicable to the operations of our customers may limit the use and adoption of our service and reduce overall demand for it. These privacy and data security related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data. Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform. In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, which broadly defines personal information and gives California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches. In addition,

on November 3, 2020, California voters passed the California Privacy Rights Act (“CPRA”) into law. The CPRA will take substantial effect on January 1, 2023 with enforcement scheduled for July 1, 2023 and will significantly modify the CCPA and create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. Since the CPRA passed, in March 2021, Virginia enacted the Virginia Consumer Data Protection Act (“CDPA”) and, in June 2021, Colorado enacted the Colorado Privacy Act (“CPA”), both of which are comprehensive privacy statutes that share similarities with the CCPA and CPRA. Some observers have noted the CCPA, CPRA, CDPA and CPA mark the beginning of a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business. Additionally, in August 2021, the National People’s Congress of the People's Republic of China adopted the Personal Information Protection Law (“PIPL”), which took effect on November 1, 2021. The PIPL, which introduces a legal framework similar to the GDPR (as defined and further described below), marks the introduction of a comprehensive system for the protection of personal information in China. We cannot yet determine the impact that the PIPL may have on our business; however, we may incur substantial expense in complying with any new obligations, we could be subject to significant fines if we are found to not comply with the PIPL, and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue. Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes. If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations our ability to successfully operate our business and pursue our business goals could be harmed.

With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact. Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be unfair, deceptive or misrepresentative of our practices.

If our platform is perceived to cause, or is otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability. Existing and potential privacy laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, products and services such as ours. Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them. If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform. This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.

We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S. data transfers.

We are subject to the EU General Data Protection Regulation 2016/679 (“GDPR”) that took effect on May 25, 2018, and, as a result of the United Kingdom’s exit from the European Union, as of January 1, 2021, the UK General Data Protection Regulation and Data Protection Act 2018 (“UK Data Protection Laws”). The GDPR and UK Data Protection Laws have enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Non-compliance with the GDPR can trigger fines of up to €20 million, or 4% of total worldwide annual revenue, whichever is higher. The UK Data Protection Laws mirror the fines under the GDPR. Given the breadth and depth of changes in data protection obligations, complying with its requirements has caused us to expend significant resources and such expenditures are likely to continue into the near future as we respond to new interpretations and enforcement actions following the effective date of the regulation and as we continue to negotiate data processing agreements with our customers and business partners. Separate EU laws and regulations (and member states’ implementations of them) govern the protection of consumers and of electronic communications and these are also evolving. A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties. We cannot yet determine the impact that such future laws, regulations and standards may have on our business. Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions. We may incur substantial expense in complying with any new obligations and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.

In addition, the GDPR restricts transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the United States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (“SCCs”) approved by the European Commission and, until July 16, 2020, the Privacy Shield for EU-U.S. data transfers. With regard to transfers to the United States of personal data from our employees and European customers and users, we rely upon the SCCs. On July 16, 2020, in what is known as the “Schrems II” decision, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the SCCs (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place. The European Commission has now issued new SCCs that account for the CJEU’s “Schrems II” decision. Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA to a country outside of the EEA. This means that we may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA to apply different standards to the transfer of personal data from the EEA to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA to the United States. We also anticipate being required to engage in new contract negotiations with third parties that aid in processing data on our behalf, and entering into the new SCCs. We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA residents. There are few viable alternatives to the SCCs, and the law in this area remains dynamic. These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.

The regulatory environment applicable to the handling of EEA residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed. We and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin. These regulations may deter

customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from the EU are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices. Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers. We may find it necessary to establish systems to maintain EU personal data within the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements. If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates. We function as a business associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a business associate for the purposes of HIPAA. The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them. These agreements impose stringent data security obligations on us. If we are unable to comply with our obligations as a HIPAA business associate or under the terms of the business associate agreements we have executed, we could face substantial civil and even criminal liability as well as contractual liability under the applicable business associate agreement, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain new customers. Modifying the already stringent penalty structure that was present under HIPAA prior to HITECH, HITECH created four new tiers of civil monetary penalties and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

The number of people who access the internet through mobile devices and access cloud-based software applications through mobile devices, including smartphones and handheld tablets or laptop computers, has increased significantly in the past several years and is expected to continue to increase. While we have created mobile applications and mobile versions of our products, if these mobile applications and products do not perform well, our business may suffer. We are also dependent on third-party application stores that may prevent us from timely updating our current products or uploading new products. In addition, our products interoperate with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties. As a result, we depend on the interoperability of our products with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control. Any changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services could adversely affect adoption and usage of our platform. Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in developing products that operate effectively with a range of operating systems, networks, devices, browsers, protocols and standards. In addition, we may face different fraud, security and regulatory risks from transactions sent from mobile devices than we do from personal computers. If we are unable to effectively anticipate and manage these risks, or if it is difficult for our customers to access and use our platform, our business, results of operations and financial condition may be harmed.

Our success also depends on the willingness of third-party developers and technology providers to build applications and provide integrations that are complementary to our service. Without the development of these applications and integrations, both current and potential customers may not find our service sufficiently attractive, and our business, results of operations and financial condition could suffer.

Interruptions or delays in the services provided by third-party data centers or internet service providers could impair the delivery of our platform and our business could suffer.

We rely on a number of third-party service providers to operate our services, any of which, if it encountered interruptions or delays, could negatively affect our platform, damage our reputation, expose us to liability, cause us to lose customers or otherwise harm our business. For example, we host our platform using AWS data centers and other third-party cloud infrastructure services. All of our products use resources operated by us in these locations. Our operations depend on protecting the virtual cloud infrastructure hosted in AWS or other cloud services by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform. A prolonged third-party service disruption affecting our platform for any of the foregoing reasons could be detrimental to our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party services we use.

Our cloud infrastructure services enable us to order and reserve server capacity in varying amounts and sizes distributed across multiple regions. These cloud infrastructure services provide us with computing and storage capacity pursuant to agreements which may be terminated under specified circumstances.

Our platform is accessed by a large number of customers, often at the same time. As we continue to expand the number of our customers and products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. In addition, the failure of third-party virtual data centers, or third-party internet service providers, or other third-party service providers whose services are integrated with our platform, to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations. In the event that our third-party service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services.

Our success depends, in part, on the integrity and scalability of our systems and infrastructures. System interruption and the lack of integration, redundancy and scalability in these systems and infrastructures may harm our business, results of operations and financial condition.

Our success depends, in part, on our ability to maintain the integrity of our systems and infrastructure, including websites, information and related systems. System interruption and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate websites, process and fulfill transactions, respond to customer inquiries and generally maintain cost-efficient operations. We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing access to our platform. We also rely on third-party computer systems, broadband and other communications systems and service providers in connection with providing access to our platform generally. Any interruptions, outages or delays in our systems and infrastructure, our business and/or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our platform. Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, other natural disasters, acts of war or terrorism and similar events or disruptions may damage or interrupt computer, broadband or other communications systems and infrastructure at any time. Any of these events could cause system interruption, delays and loss of critical data, and could prevent us from providing access to our platform. While we have backup systems for certain aspects of these operations, disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. If any of these events were to occur, it could harm our business, results of operations and financial condition.

We rely on software and services from other parties. Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our products.

We rely on technologies from third parties to operate critical functions of our business, including cloud infrastructure services and customer relationship management services. Our business would be disrupted if any of the third-party software or services we use, or functional equivalents, were unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. In each case, we would be required to either seek licenses to software or services from other parties and redesign our products to function with such software or services or develop substitutes ourselves, which would result in increased costs and could result in delays in our product launches and the release of new product offerings until equivalent technology can be identified, licensed or developed, and integrated into our products. Furthermore, we might be forced to limit the features available in our current or future products. These delays and feature limitations, if they occur, could harm our business, results of operations and financial condition.

Real or perceived errors, failures, vulnerabilities or bugs in our products, including deployment complexity, could harm our business and results of operations.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.

Our success is dependent, in part, upon protecting our proprietary information and technology. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours. Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries. Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate. To the extent we expand our international activities, our exposure to unauthorized copying and use of our products and proprietary information may increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property.

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position. Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our products.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our products, impair the functionality of our products, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new products, and we cannot ensure that we can license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

Our results of operations may be harmed if we are subject to an infringement claim or a claim that results in a significant damage award.

There is considerable patent and other intellectual property development activity in our industry, and we expect that software companies will increasingly be subject to infringement claims as the number of products and competitors grows and the functionality of products in different industry segments overlaps. In addition, the patent portfolios of many of our competitors are larger than ours, and this disparity may increase the risk that our competitors may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. Other companies have claimed in the past, and may claim in the future, that we infringe upon their intellectual property rights. A claim may also be made relating to technology that we acquire or license from third parties. Further, we may be unaware of the intellectual property rights of others that may cover some or all of our technology.

Any claim of infringement, regardless of its merit or our defenses, could:

Any one or more of the above could harm our business, results of operations and financial condition.

We use open source software in our products, which could negatively affect our ability to offer our products and subject us to litigation or other actions.

We use open source software in our products and expect to use more open source software in the future. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products. However, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our results of operations and financial condition or require us to devote additional research and development resources to change our products. In addition, if we were to combine our proprietary software products with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar products with less development effort and time. If we inappropriately use open source software, or if the license terms for open source software that we use change, we may be required to re-engineer our products, incur additional costs, discontinue the sale of some or all of our products or take other remedial actions.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title or controls on origin of the software. In addition, many of the risks associated with usage of open source software, such as the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not subject us to liability.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform. Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.

Because we generally recognize revenue from our subscriptions and support services over the term of the relevant service period, a decrease in sales during a reporting period may not be immediately reflected in our results of operations for that period.

We generally recognize revenue from subscriptions and related support services revenue ratably over the relevant service period. Net new revenue from new subscriptions, upsells and renewals entered into during a period can generally be expected to generate revenue for the duration of the service period. As a result, most of the revenue we report in each period is derived from the recognition of deferred revenue relating to subscriptions and support services contracts entered into during previous periods. Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period. In addition, our ability to adjust our cost structure in the event of a decrease in new or renewed subscriptions may be limited.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

We may face exposure to foreign currency exchange rate fluctuations.

Today, a vast majority of our customer contracts are denominated in U.S. dollars. Over time, however, an increasing portion of our international customer contracts may be denominated in local currencies. In addition, the majority of our international costs are denominated in local currencies. As a result, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S. Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, U.S. Travel Act, the USA PATRIOT Act, the U.K. Bribery Act 2010 and other anti-corruption, anti-bribery and anti-money laundering laws in countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly and prohibit companies and their employees and agents from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the private sector. As we increase our international sales and business, our risks under these laws may increase.

In addition, we use channel partners to sell our products and conduct business on our behalf abroad. We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-

owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities. We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

Noncompliance with the FCPA, other applicable anti-corruption laws, or anti-money laundering laws could subject us to investigations, whistleblower complaints, sanctions, settlements, prosecution, and other enforcement actions. Any violation of these laws could result in disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, loss of export privileges, severe criminal or civil sanctions, suspension or debarment from U.S. government contracts and other consequences, any of which could have a material adverse effect on our reputation, business, results of operations, and financial condition.

We are subject to governmental export controls and economic sanctions laws that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Our business activities are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control. The U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items. In addition, various countries regulate the import of certain encryption technology, including through import and licensing requirements, and have enacted laws that could limit our ability to distribute our service or could limit our customers’ ability to implement our service in those countries. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities. Although we take precautions to prevent our products from being provided in violation of such laws, our products may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. This could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

Our international operations may give rise to potentially adverse tax consequences.

We are expanding our international operations and staff to better support our growth into the international markets. Our corporate structure and associated transfer pricing policies anticipate future growth into the international markets. The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which are generally required to be computed on an arm’s-length basis pursuant to intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency.

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.

New income, sales, use, value-added or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time. Those enactments could harm our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due. If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to purchase our products in the future. Additionally,

new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business and financial performance. For example, various legislative and regulatory actions and proposals, such as in the United States, the Organisation for Economic Co-operation and Development and the EU, have increasingly focused on future tax reform and contemplate changes to long-standing tax principles, which could adversely affect our liquidity and results of operations.

As a multinational organization, we may be subject to taxation in certain jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could harm our liquidity and results of operations. In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries, any of which could harm us and our results of operations.

Our business may be subject to additional obligations to collect and remit sales tax and other taxes, and we may be subject to tax liability for past sales. Any successful action by state, foreign or other authorities to collect additional or past sales tax could harm our business.

State, foreign and local taxing jurisdictions have differing rules and regulations governing sales, use and other indirect taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of sales and value-added taxes to our platform in various jurisdictions is unclear. It is possible that we could face tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. We could also be subject to audits in states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion that we should be collecting additional sales or other taxes on our service in jurisdictions where we have not historically done so and do not accrue for such taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise harm our business, results of operations and financial condition.

We file sales tax returns in certain states within the United States as required by law and certain customer contracts for a portion of the products that we provide. We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the vast majority of the products that we provide. However, one or more states or foreign authorities could seek to impose additional sales, use or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. Liability for past taxes may also include substantial interest and penalty charges. Any successful action by state, foreign or other authorities to compel us to collect and remit sales tax, use tax or other taxes, either retroactively, prospectively or both, could harm our business, results of operations and financial condition.

Our ability to use our U.S. net operating loss carry-forwards and certain other tax attributes may be limited.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to maintain the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs and significant management oversight. If any of these new or improved controls and systems do not perform as expected, we may experience material weaknesses or significant deficiencies in our controls.

Our controls may become inadequate because of changes in conditions in our business. Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to maintain effective controls could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the Nasdaq. We are required to provide an annual management report on the effectiveness of our internal control over financial reporting.

Our independent registered public accounting firm is required to formally attest to the effectiveness of our internal control over financial reporting annually. Our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our internal control over financial reporting is documented, designed, or operating. Any failure to maintain effective disclosure controls and internal control over financial reporting could harm our business and results of operations and could cause a decline in the price of our Class A common stock.

Changes in existing financial accounting standards or practices, or taxation rules or practices, may harm our results of operations.

Changes in existing accounting or taxation rules or practices, new accounting pronouncements or taxation rules, or varying interpretations of current accounting pronouncements or taxation practice could harm our results of operations or the manner in which we conduct our business. Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to those related to the valuation of goodwill and purchased intangible assets arising from business combinations, revenue recognition, period of benefit for deferred commissions, incremental borrowing rates for operating leases, effective interest rates for convertible notes, valuation of deferred income taxes and valuation of certain equity awards assumed. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Risks Related to Ownership of Our Class A Common Stock

The stock price of our Class A common stock may be volatile or may decline.

Prior to our IPO, there was no public market for shares of our Class A common stock. The market prices of the securities of other newly public companies have historically been highly volatile, and our stock price has been volatile since our IPO. The market price of our Class A common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 42.6% of the voting power of our capital stock as of January 31, 2022. This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

Future transfers by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of Class B common stock who have retained their shares.

Sales of a substantial number of shares of our Class A common stock in the public markets, or the perception that sales might occur, could cause the market price of our Class A common stock to decline.

Sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and principal stockholders, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline.

In addition, we have options outstanding that, if fully exercised, would result in the issuance of shares of our Class A and Class B common stock. We also have restricted stock units (“RSUs”) outstanding that, if vested and settled, would result in the issuance of shares of Class A common stock. All of the shares of Class A and Class B common stock issuable upon the exercise of stock options and vesting of RSUs and the shares reserved for future issuance under our equity incentive plans, are registered for public resale under the Securities Act of 1933, as amended (“Securities Act”). Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.

Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below) issued at the time of the issuance of the 2023 Notes (as defined below). If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.

If securities or industry analysts do not publish or cease publishing research, or publish inaccurate or unfavorable research, about our business, the price of our Class A common stock and trading volume could decline.

The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us or our business. If industry analysts do not publish or cease publishing research on our company, the trading price for our Class A common stock would be negatively affected. If one or more of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about our business, our Class A common stock price would likely decline. If one or more of these analysts cease coverage of us or fail to publish reports on us on a regular basis, demand for our Class A common stock could decrease, which might cause our Class A common stock price and trading volume to decline.

We do not intend to pay dividends for the foreseeable future.

We have never declared or paid any cash dividends on our common stock and do not intend to pay any cash dividends in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the operation of our business and for general corporate purposes. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current board of directors, and limit the market price of our Class A common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management. Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

Our amended and restated bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Our amended and restated bylaws provide that the Court of Chancery of the State of Delaware will be the exclusive forum for:

Servicing our debt may require a significant amount of cash. We may not have sufficient cash flow from our business to pay our indebtedness.

We may not have the ability to raise the funds necessary for cash settlement upon conversion of the Notes or to repurchase the Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the Notes or to repurchase the Notes.

Holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (as defined in the indentures governing their respective Notes) at a repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid interest, if any. Upon conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted. We may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of Notes surrendered or Notes being converted. In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase Notes at a time when the repurchase is required by the indenture governing such notes or to pay any cash payable on future conversions of the Notes as required by such indenture would constitute a default under such indenture. A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions.

In the event the conditional conversion feature of the Notes is triggered, holders of the Notes will be entitled to convert the Notes, as applicable, at any time during specified periods at their option. If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity. As disclosed in Note 9 to our consolidated financial statements, the conditional conversion features of the 2023 Notes were triggered as of January 31, 2022, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between February 1, 2022 and April 30, 2022. Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future. The conditional conversion features of the 2025 Notes were triggered as of January 31, 2021 and the 2025 Notes were convertible at the option of the holders between February 1, 2021 and April 30, 2021; however, as of January 31, 2022, the conditions allowing holders of the 2025 Notes to convert were not met. From the date of issuance through January 31, 2022, the conditions allowing holders of the 2026 Notes to convert were not met.

Transactions relating to our Notes may affect the value of our Class A common stock.

The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in San Francisco, California and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business. For example, in the fall of 2019 and 2020, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, terrorist attack or health epidemic (including COVID-19), we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition. In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

Our corporate headquarters is located in San Francisco, California, where we currently lease approximately 285,996 square feet under a lease, as amended, that expires in October 2028. We are entitled to two five-year options to extend this lease, subject to certain requirements.

We also lease space in various locations in the Americas, Europe and Asia-Pacific.

Part II

Our Class A common stock has been listed on the Nasdaq Global Select Market under the symbol "OKTA" since April 7, 2017. Prior to that date, there was no public trading market for our Class A common stock. Our Class B common stock is not listed or traded on any stock exchange.

As of February 28, 2022, we had 233 holders of record of our Class A common stock and 19 holders of record of our Class B common stock. The actual number of Class A beneficial stockholders is substantially greater than the number of holders of record because a large portion of our Class A common stock is held in street name by brokers and other nominees.

We have never declared or paid cash dividends on our capital stock. We currently intend to retain any future earnings for use in the operation of our business and do not intend to declare or pay any cash dividends in the foreseeable future. Any further determination to pay dividends on our capital stock will be at the discretion of our board of directors, subject to applicable laws, and will depend on our financial condition, results of operations, capital requirements, general business conditions and other factors that our board of directors considers relevant.

We have presented below the cumulative total return to our stockholders from April 7, 2017 (the date our Class A common stock commenced trading on the Nasdaq) through January 31, 2022 in comparison to the Standard & Poor’s 500 Index and Standard & Poor Information Technology Index. All values assume a $100 initial investment and data for the Standard & Poor’s 500 Index and Standard & Poor Information Technology Index assume reinvestment of dividends. The comparisons are based on historical data and are not indicative of, nor intended to forecast, the future performance of our Class A common stock.

Securities Authorized for Issuance under Equity Compensation Plans

Unregistered Sales of Equity Securities

Overview

On May 3, 2021, we completed the acquisition of Auth0, Inc ("Auth0"). The acquisition date fair value, net of acquired cash and subject to final adjustments, was approximately $5,671.0 million, including approximately 19.2 million shares of our Class A common stock valued at $5,175.6 million, $257.0 million in cash, and assumed equity awards with an initial fair market value of $238.4 million. In addition, we issued unvested restricted stock valued at $332.1 million and assumed unvested equity and restricted cash awards valued at $430.2 million, which are subject to future vesting and will be recorded as expense over the period the services are provided. Approximately 5% of the total consideration was held back by us to secure the indemnification obligations of the Auth0 securityholders arising during the twelve months following the closing. The estimated transaction value of approximately $6,500.0 million includes restricted stock and assumed equity and restricted cash awards subject to future vesting and was based on the fixed conversion stock price specified in the Merger Agreement. Further, the estimated transaction value excludes the impact of cash acquired and other customary closing purchase price adjustments. See Note 3 to our consolidated financial statements included elsewhere in this Annual Report on Form 10-K.

We operate our business as one reportable segment. Our revenue has grown significantly. For the years ended January 31, 2022, 2021 and 2020, our revenue was $1,300.2 million, $835.4 million and $586.1 million, respectively, representing a growth rate of 56% and 43%, respectively. For the years ended January 31, 2022, 2021 and 2020, we generated net losses of $848.4 million, $266.3 million and $208.9 million, respectively. Our accumulated deficit as of January 31, 2022 was $1,815.9 million.

Revenue

costs and related amortization may increase. We expect our investment in technology to expand the capability of our platform enabling us to improve our gross margin over time. The level and timing of investment in these areas could affect our cost of subscription revenue in the future.

Our provision for (benefit from) income taxes consists of federal and state income taxes in the United States and income taxes in certain foreign jurisdictions where we operate. The primary difference between our effective tax rate and the federal statutory rate relates to the net operating losses in jurisdictions with a valuation allowance against related deferred tax assets.

Comparison of the Years Ended January 31, 2022 and 2021

Professional services and other revenue increased by $12.2 million, or 31%, for the year ended January 31, 2022 compared to the year ended January 31, 2021. The increase in professional services revenue was primarily related to an increase in implementation and other services associated with growth in the number of new customers purchasing our subscription services, as well as the inclusion of Auth0 revenue from the acquisition date.

The business combination with Auth0 contributed approximately $139.7 million in total revenue for the period from the acquisition date.

that are required by GAAP to be recorded in our financial statements. In addition, they are subject to inherent limitations as they reflect the exercise of judgment by our management about which expenses are excluded or included in determining these non-GAAP financial measures. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of these non-GAAP financial measures to their most directly comparable GAAP financial measures, and not to rely on any single financial measure to evaluate our business.

Non-GAAP Operating Income (Loss) and Non-GAAP Operating Margin

Calculated Billings

Liquidity and Capital Resources

In February 2018, we completed our private offering of the 2023 Notes due on February 15, 2023 and received aggregate proceeds of $345.0 million, before deducting costs of issuance of $10.0 million. The interest rate on the 2023 Notes is fixed at 0.25% per annum and is payable semi-annually in arrears on February 15 and August 15 of each year, beginning on August 15, 2018. In connection with the issuance of the 2023 Notes, we entered into convertible note hedges ("Note Hedges") with respect to our Class A common stock. We used an aggregate amount of $80.0 million of the net proceeds from the sale of the 2023 Notes to purchase the Note Hedges. The cost of the Note Hedges was partially offset by proceeds of $52.4 million from the sale of warrants to purchase shares of our Class A common stock ("Warrants") in connection with the issuance of the 2023 Notes.

In September 2019, we completed our private offering of the 2025 Notes due on September 1, 2025 and received aggregate proceeds of $1,060.0 million, before deducting issuance costs of approximately $19.3 million. The interest rate on the 2025 Notes is fixed at 0.125% per annum and is payable semi-annually in arrears on March 1 and September 1 of each year, beginning on March 1, 2020. In connection with the 2025 Notes, we entered into capped call transactions ("2025 Capped Calls") with respect to our Class A common stock. We used an aggregate amount of $74.1 million of the net proceeds from the sale of the 2025 Notes to purchase the 2025 Capped Calls.

associated with the development of additional features and functionality for our platform. These activities were partially offset by proceeds from the sales and maturities of investments of $1,711.8 million.

Cash provided by financing activities during the year ended January 31, 2022 of $89.1 million was primarily attributable to proceeds from the exercise of stock options of $53.5 million, and proceeds from employee purchases under our employee stock purchase plan ("ESPP") of $35.6 million.

Obligations and Other Commitments

Indemnification Agreements

Critical Accounting Policies and Estimates

usage or service level, the customer has no right of refund. Our subscription arrangements do not provide customers with the right to take possession of the software supporting the platform and, as a result, are accounted for as service arrangements. This revenue recognition policy is consistent for sales generated directly with customers and sales generated indirectly through channel partners.

Some of our contracts with customers contain multiple performance obligations. For these contracts, we account for individual performance obligations separately if they are distinct. The transaction price is allocated to the separate performance obligations on a relative stand-alone selling price ("SSP") basis. We determine SSP based on observable prices, if available, for those related services when sold separately. When such observable prices are not available, we determine SSP based on overarching pricing objectives and strategies, taking into consideration market conditions and other factors, including customer size, volume purchased, market and industry conditions, product-specific factors and historical sales of the deliverables.

Business Combinations

Similarly, in accordance with ASC 470-20, transactions involving contemporaneous exchanges of cash between the same debtor and creditor in connection with the issuance of a new debt obligation and satisfaction of an existing debt obligation by the debtor should be evaluated as a modification or an exchange transaction depending on whether the exchange is determined to have substantially different terms. When the exchange is deemed to have substantially different terms due to a significant difference between the value of the conversion option immediately prior to and after the exchange, the transaction is accounted for as a debt extinguishment. Pursuant to ASC 470-20, total consideration for the satisfaction of an existing debt obligation is separated into liability and equity components by estimating the fair value of a similar liability without a conversion option and assigning the residual value to the equity component. The effective interest rate used to estimate the fair value of the liability component is based on the income and market based approaches used to determine the effective interest rate of the new debt obligation, adjusted for the remaining tenor of the extinguished debt. The difference between the fair value and the amortized carrying value of the extinguished debt, net of the proportionate amounts of unamortized debt discount and remaining unamortized debt issuance costs, is recorded as a gain or loss on extinguishment.

Foreign Currency Exchange Risk

Notes will increase as interest rates fall and decrease as interest rates rise. In addition, the fair value of the Notes fluctuates when the market price of our common stock fluctuates. The fair value was determined based on the quoted bid price of the Notes in an over-the-counter market on the last trading day of the reporting period. See Note 5 to our consolidated financial statements for more information.

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors of Okta, Inc.

We have audited the accompanying consolidated balance sheets of Okta, Inc. (the Company) as of January 31, 2022 and 2021, the related consolidated statements of operations, comprehensive loss, stockholders' equity (deficit), and cash flows for each of the three years in the period ended January 31, 2022, and the related notes (collectively referred to as the “consolidated financial statements”). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company at January 31, 2022 and 2021, and the results of its operations and its cash flows for each of the three years in the period ended January 31, 2022, in conformity with U.S. generally accepted accounting principles.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company's internal control over financial reporting as of January 31, 2022, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) and our report dated March 7, 2022 expressed an unqualified opinion thereon.

These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on the Company’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

The critical audit matters communicated below are matters arising from the current period audit of the financial statements that were communicated or required to be communicated to the audit committee and that: (1) relate to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matters below, providing separate opinions on the critical audit matters or on the accounts or disclosures to which they relate.

To the Stockholders and the Board of Directors of Okta, Inc.

We have audited Okta, Inc.’s internal control over financial reporting as of January 31, 2022, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). In our opinion, Okta, Inc. (the Company) maintained, in all material respects, effective internal control over financial reporting as of January 31, 2022, based on the COSO criteria.

As indicated in the accompanying Management’s Report on Internal Control Over Financial Reporting, management’s assessment of and conclusion on the effectiveness of internal control over financial reporting did not include the internal controls of Auth0, Inc. which is included in the 2022 consolidated financial statements of the Company and constituted 2% of consolidated total assets and 11% of consolidated revenue for the year then ended. Our audit of internal control over financial reporting of the Company also did not include an evaluation of the internal control over financial reporting of Auth0, Inc.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of January 31, 2022 and 2021, the related consolidated statements of operations, comprehensive loss, stockholders' equity (deficit), and cash flows for each of the three years in the period ended January 31, 2022, and the related notes and our report dated March 7, 2022 expressed an unqualified opinion thereon.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects.

Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

See Notes to Consolidated Financial Statements.