Amgen Inc.: 10-K Risk Factor Changes

Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions. We seek innovation through significant investment in both internal R&D and external transactions, including collaborations, partnerships, alliances, licenses, joint ventures, mergers and acquisitions (collectively, acquisition activity). 35 35 35 Acquisition activities may be subject to regulatory approvals or other requirements that are not within our control. Antitrust scrutiny by regulatory agencies and changes to regulatory approval process in the U.S. and foreign jurisdictions may cause approvals to take longer than anticipated to obtain, not be obtained at all, or contain burdensome conditions, which may jeopardize, delay or reduce the anticipated benefits of acquisitions to us and could impede the execution of our business strategy. There can be no assurance that such regulatory or other approvals will be obtained or that all closing conditions required in connection with our acquisition activities will be satisfied or waived, which could result in us being unable to complete the planned acquisition activities. Acquisition activities are complex, time consuming and expensive and may result in unanticipated costs, delays or other operational or financial problems related to integrating the acquired company and business with our company, which may divert our management’s attention from other business issues and opportunities and restrict the full realization of the anticipated benefits of such transactions within the expected timeframe or at all. We may pay substantial amounts of cash, incur debt or issue equity securities to pay for acquisition activities, which could adversely affect our liquidity or result in dilution to our stockholders, respectively. For example, the primary sources of funds for our acquisition of Horizon were those received from our $24 billion of senior notes issued on March 2, 2023, together with the $4 billion drawn down from our term loan facility, and while the Company currently has investment grade credit ratings, this substantial additional indebtedness has resulted in downgrades to our credit ratings. Further, failures or difficulties in integrating or retaining new personnel or in integrating the operations of the businesses, products or assets we acquire (including related technology, research, development and commercial operations, compliance programs, manufacturing, distribution and general business operations and procedures and ESG activities) may affect our ability to realize the benefits of the transaction and grow our business and may result in us incurring asset impairment or restructuring charges. These and other challenges may arise in connection with our acquisitions of Otezla, Five Prime, Teneobio, ChemoCentryx, Horizon and/or our collaborations with BeiGene and Kyowa Kirin, or with other acquisition activities, which could have a material adverse effect on our business, results of operations and stock price. We may not realize the anticipated strategic benefits of our acquisition of Horizon, including our efforts to leverage Amgen’s global presence and commercial and medical capabilities in inflammation and nephrology to accelerate revenue growth of Horizon’s products. Our assumptions and estimates about the future revenue growth of Horizon’s products may prove to be incorrect. Sales of our rare disease products acquired through our acquisition of Horizon will depend on our ability to increase awareness and educate physicians on the rare conditions that such medicines are designed to treat, as well as successfully identifying target patients and educating them about our treatments. We may also face greater than expected challenges associated with rare disease drug development (such as challenges obtaining patients for clinical trials and/or regulatory approvals) and reimbursement (such as obtaining reimbursement of orphan drugs by public health systems). We are in the process of integrating the Horizon business into ours, including a large number of complex operational and administrative systems, to form a unified combined company, including with respect to human resources, intellectual property management, research and development activities, finance, accounting and internal control processes and systems, sales operations, product distribution, commercialization efforts, information and information security systems, compliance programs and policies and supply chain systems and third party relationships (including vendors and third party manufacturers). For example, Horizon adds more than 30 contract manufacturing organizations (CMOs) to our operations, many of which are single source suppliers (including the CMO that produces TEPEZZA drug substance and the CMO that produces all of our KRYSTEXXA drug substance in Israel that is affected by the current conflict in Israel and Gaza). Business integrations generally, and our integration of Horizon specifically, are complex, time consuming and expensive, and we may experience unanticipated costs, delays or other operational or financial challenges. These integration efforts may also divert our management’s attention and resources away from other business operations, which may disrupt to some degree our ongoing business. Failure to successfully integrate the Horizon business into ours and/or achieve its anticipated strategic benefits may result in our incurring significant asset impairment or restructuring charges, and could have a material adverse effect on our business, results of operations and stock price. We may not be able to access the capital and credit markets on terms that are favorable to us, or at all. The capital and credit markets may experience extreme volatility and disruption, which may lead to uncertainty and liquidity issues for both borrowers and investors. For example, in early 2020, there were significant disruptions in the commercial paper market and several borrowers were unable to obtain funding at normal rates or maturities, which resulted in a significant increase in draws of corporate credit lines with banks. Similarly, the bond markets experienced extreme volatility in terms of interest rates and credit spreads, with several days without new issuances of corporate bonds. While we have historically accessed capital markets to supplement our existing funds and cash generated from operations to satisfy our needs for capital expenditures, debt service requirements, to pay dividends and repurchase stock, and engage in other business initiatives, including acquisitions and licensing activities, in 2023, we substantially increased our outstanding indebtedness in connection with our acquisition of Horizon, which may limit our ability to timely obtain additional financing on desired terms. See Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the 36 36 36 operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions. While our plans include reducing our debt leverage levels before returning to the capital or credit markets for new funds, if we are required to access the capital and credit markets at an inopportune time, including when adverse capital and credit market conditions prevail, we may be unable to obtain financing on favorable terms, or at all, which could have a material adverse effect on our business and results of operations or our ability to complete business acquisitions. Changes in credit ratings issued by nationally recognized credit-rating agencies could also adversely affect our ability to obtain capital and credit market financing and the cost of such financing and have an adverse effect on the market price of our securities. A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation. Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of at many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing. We have also experienced denial of service attacks against our network, and, although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta’s internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations. 37 37 37 Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events and such events could have a material adverse effect on our business. Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. For example, in December 2021, a remote code execution vulnerability was discovered in a software library that is widely used in a variety of commercially available software and services. Although this vulnerability has not resulted in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations. Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors’ systems. While we were able to reconnect our systems following restoration of these vendors’ capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data. Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data. 38 38 38 We are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU’s GDPR, which became effective in May 2018, and the CCPA, which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in Virginia, Colorado, Utah, Connecticut and Florida in 2023. Consumer privacy laws were also passed in eleven other states, with the earliest effective dates later this year, and proposed in three additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, similar legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations. Our sales and operations are subject to the risks of doing business internationally, including in emerging markets. As we continue our expansion efforts in emerging markets around the world, through acquisitions and licensing transactions as well as through the development and introduction, both independently and through collaborations such as our collaboration with BeiGene, of our products in new markets, we face numerous risks to our business. There is no guarantee that our efforts and strategies to expand sales in emerging markets will succeed. Our international business, including in China and emerging market countries, may be especially vulnerable to periods of global and local political, legal, regulatory and financial instability, including issues of geopolitical relations, the imposition of international sanctions in response to certain state actions and/or sovereign debt issues, and management of health policy in response to pressures such as global pandemics. If relations between the United States and other governments deteriorate, our business and investments in such markets may also be adversely affected. We may also be required to increase our reliance on third-party agents and unfamiliar operations and arrangements including those previously utilized by companies we partner with or acquire in emerging markets. See We must conduct clinical trials in humans before we commercialize and sell any of our product candidates or existing products for new indications. Our expansion efforts in China and emerging markets around the world are dependent upon the establishment of an environment that is predictable, navigable and supportive of biopharmaceutical innovation, sustained access for our products and predictable pricing controls. For example, China continues to strengthen regulations on the collection, use and transmission of Chinese human genetic resources, and has expanded regulations on the conduct of biotechnology R&D activities in China. Between 2020 and 2022, we experienced delays in our applications to the Human Genetic Resources Administration of China that sought approval to conduct clinical trials in China. Our international operations and business may also be subject to less protective intellectual property or other applicable laws, diverse data privacy and protection requirements, changing tax laws and tariffs, trade restrictions or other barriers designed to protect industry in the home country against foreign competition, far-reaching antibribery and anticorruption laws and regulations and/or evolving legal and regulatory environments. For example, recent cross-border data transfer compliance requirements in China may also impose additional costs of doing business, including costs associated with localizing operations. In response to the ongoing armed conflict in Ukraine, the U.S. government, numerous state governments, the EU and other countries in which we conduct business have imposed a wide range of economic sanctions that restrict commerce and business dealings with Russia, certain regions of Ukraine and certain entities and individuals. Additionally, the armed conflict in the Middle East that has been ongoing since October 2023 has caused regional disruptions to economic activity. For a description of the conflict’s impact on our third-party contract manufacturing of KRYSTEXXA, see Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions. These conflicts may also precipitate or amplify the other risks described herein, including risks relating to cybersecurity, global economic conditions, clinical trials and supply chains, which could adversely affect our business, operations and financial condition and results. As we expand internationally, we are subject to fluctuations in foreign currency exchange rates relative to the U.S. dollar. While we have a program in place that is designed to reduce our exposure to foreign currency exchange rate fluctuations through foreign currency hedging arrangements, our hedging efforts do not completely offset the effect of these fluctuations on our revenues and earnings. Overall, the legal and operational challenges of our international business operations, along with government controls, the challenges of attracting and retaining qualified personnel and obtaining and/or maintaining necessary regulatory or pricing approvals of our products, may result in material adverse effects on our international product sales, business and results of operations. 39 39 39

The COVID-19 pandemic, and the public and governmental effort to mitigate against the spread of the disease, have had, and are expected to continue to have, an adverse effect, and may have a material adverse effect, on our clinical trials, operations, manufacturing, supply chains, distribution systems, product development, product sales, business and results of operations. The novel coronavirus identified in late 2019, SARS-CoV-2, which causes the disease known as COVID-19, is an ongoing global pandemic that has resulted in public and governmental efforts to contain or slow the spread of the disease, including widespread shelter-in-place orders, social distancing interventions, quarantines, travel restrictions and various forms of operational shutdowns. The COVID-19 pandemic and the resulting measures implemented in response to the pandemic are adversely affecting, and are expected to continue to adversely affect, our business (including our R&D, clinical trials, operations, manufacturing, supply chains, distribution systems, product development and sales activities), the business activities 28 28 28 of our suppliers, customers, third-party payers and our patients. See Our current products and products in development cannot be sold without regulatory approval; see also We must conduct clinical trials in humans before we commercialize and sell any of our product candidates or existing products for new indications. Due to the pandemic and these measures and their effects, we have experienced, and expect to continue to experience, unpredictable reductions in demand for certain of our products, exacerbated by COVID-19 surges resulting in repeated shutdowns and/or disruptions in certain geographies. Federal, state and local, and international governmental policies and initiatives designed to reduce the transmission of COVID-19 also have resulted in the cancellation or delay of diagnostic, elective, specialty and other procedures and appointments to avoid non-essential patient exposure to medical environments and potential infection with COVID-19 and to focus limited resources and personnel capacity toward the treatment of COVID-19. For example, an NPR/Harvard poll in 2021 found that, with hospitals crowded from COVID-19, one in five U.S. households had to delay care for serious illnesses. These measures and challenges will likely continue to varying degrees and have significantly reduced patient access to, and administration of, certain of our drugs. For example, Prolia requires administration by a healthcare provider in doctors’ offices or other healthcare settings that are affected by COVID-19. The U.S. label for Prolia instructs healthcare professionals who discontinue Prolia to transition the patient to an alternative antiresorptive, including oral treatments that do not require administration by a healthcare provider. Further, as a result of COVID-19, oncology patients, in consultation with their doctors, may be selecting therapies that are less immunosuppressive or therapies that do not require administration in a hospital setting, potentially adversely affecting sales of certain of our products. Also, new patients have been, and are expected to continue to be, less likely to be diagnosed and/or to start therapeutics during the pandemic, and these effects, together with the lower treatment rates during the pandemic, have had, and are expected to continue to have, a cumulative negative effect on the commercial performance of our business. The decrease in diagnoses over the course of the pandemic has suppressed the volume of new patients starting treatment, which we expect to continue to impact our business. As COVID-19 infection rates ebb and flow, we anticipate there could be periodic backlogs of patients seeking appointments with physicians relating to a variety of medical conditions, and as a result, patients seeking treatment with certain of our products may have to navigate lower provider capacity, and this lower provider capacity could have a continued adverse effect on our sales. Further, the effects of the COVID-19 pandemic may result in long-term shifts in preferences among healthcare professionals and patients toward treatments that do not require administration by healthcare professionals or visits to medical facilities. As the pandemic continues, and if conditions worsen or if the duration of the pandemic extends significantly, we expect to experience additional adverse effects on our development, operational and commercial activities, customer purchases and our collections of accounts receivable. It remains uncertain the degree to which these adverse effects would impact our future operational and commercial activities, customer purchases and our collections as conditions begin to improve. There was a resurgence in COVID-19 infections in numerous jurisdictions in 2022, resulting in the reinstatement of stricter restrictions and shutdowns in a number of jurisdictions, including in the United States, Europe and Asia Pacific regions. It is expected that the pandemic will continue to ebb and flow, with different jurisdictions having higher levels of infections than others over the course of the pandemic. New variants of the SARS-CoV-2 virus have emerged, including the delta and omicron variants and its subvariants, and have been shown to be present in many geographies and appear to spread more easily and quickly than other variants. Further, although some studies suggest that antibodies generated with currently authorized vaccines may be effective against these variants, it remains uncertain whether currently available vaccines will retain their efficacy against future variants of the virus. Further, even while vaccine booster shots are available for certain patients, persistent vaccine hesitancy may result in under-vaccinated populations which may prolong the duration of the COVID-19 pandemic and continue to disrupt the availability of healthcare services to the patients we serve. Jurisdictions may implement, continue or reinstate border closures, impose or reimpose prolonged quarantines and further restrict travel and business activity. These measures could significantly affect our ability to support our operations and customers and the ability of our employees to get to their workplaces to discover, study, develop and produce our product candidates and products, disrupt the movement of our products through the supply chain, and further prevent or discourage patients from participating in our clinical trials, seeking healthcare services and the administration of certain of our products. The increased availability of remote working arrangements in response to the COVID-19 pandemic has expanded the pool of companies that can compete for our employees and employment candidates. Further, in connection with the global outbreak and spread of COVID-19 and in an effort to increase the wider availability of needed medical products, we or our suppliers may elect to, or governments may require us or our suppliers to, allocate manufacturing capacity (for example pursuant to the U.S. Defense Production Act) in a way that adversely affects our regular operations, customer relationships and financial results. In the United States, on January 21, 2021, President Biden issued an Executive Order instructing federal agencies to use all available legal authorities, including the Defense Production Act, to improve current and future pandemic response and biological threat preparedness. The rapid reallocation of resources for the treatment and prevention of COVID-19 (including the production of COVID-19 vaccines or related therapies, such as our agreement to contribute to the production of COVID-19 antibody therapies for Lilly) and/or disruptions and shortages in the global supply chain caused by the pandemic, could also result in increased competition for, or reduced availability of, materials or components used in the development, manufacturing, distribution or administration of our products. For example, during the second quarter of 2021, an industry-wide shortage of certain lab kit supplies necessary for some activities that support our 29 29 29 clinical trials has developed that we are actively monitoring and managing. We have also experienced challenges in obtaining certain COVID-19-related supplies, including COVID-19 antigen rapid test kits for our staff, as a result of high demand and limited supplies during the omicron variant surge. In addition, unpredictable increases in demand for certain of our products could exceed our capacity to meet such demand, which could adversely affect our financial results and customer relationships. The COVID-19 pandemic and the volatile global economic conditions stemming from it may precipitate or amplify the other risks described in this “Risk Factors” section, which could materially adversely affect our business, operations and financial condition and results. For example, if a natural disaster or other potentially disruptive event occurs concurrently with the COVID-19 pandemic, such disaster or event could deplete our inventory levels and we could experience a disruption to our manufacturing or ability to supply our products. The rapid development and fluidity of the pandemic precludes any prediction as to the ultimate effect of COVID-19 on us. The duration of the measures being taken by the authorities to mitigate against the spread of COVID-19 (including the distribution and/or availability of vaccines and boosters), and the extent to which such measures are effective, if at all, remain highly uncertain. The magnitude and degree of COVID-19’s adverse effect on our business (including our product development, product sales, operating results and resulting cash flows) and financial condition will be driven by the severity and duration of the pandemic, the pandemic’s effect on the United States and global economies and the timing, scope and effectiveness of federal, state, local and international governmental responses to the pandemic. If mitigation of the pandemic continues to require further shelter-in-place and shutdown orders and/or restrictions on individual and/or group conduct, any adverse effects of the COVID-19 pandemic will likely grow and could be enduring, and our business and financial position could be materially adversely affected. A breakdown of our information technology systems, cyberattack or information security breach could compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. To achieve our business objectives, we rely on sophisticated information technology systems, including software, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation. Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. The complexity and interconnected nature of our systems makes them potentially vulnerable to breakdown or other service interruptions. Upgrades or changes to our systems or the software that we use may result in the introduction of new cybersecurity vulnerabilities and risks. In 2022 we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address any future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication and intensity, and are becoming increasingly difficult to detect. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, that can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering. We have also experienced denial of service attacks against our network, and although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by governmental entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products in certain markets were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed 30 30 30 attackers to access Okta’s internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations. Our systems also contain and utilize a high volume of sensitive data, including intellectual property, trade secrets, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to process, store, manage or transmit such data, which may increase our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events and such events could have a material adverse effect on our business. Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. For example, in December 2021, a remote code execution vulnerability was discovered in a widely used software library that is used in a variety of commercially available software and services. Although this vulnerability has not resulted in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations. Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks, and security breaches of their systems or service outages could adversely affect our security, leave us without access to important systems, products, raw materials, components, services or information or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors’ systems. While we were able to reconnect our systems following restoration of these vendors’ capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems. However, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal, business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data. 31 31 31 We are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU’s GDPR, which became effective in May 2018, and the CCPA, which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Virginia, Colorado, Utah and Connecticut have all subsequently passed similar consumer privacy laws, which went into effect in Virginia as of January 1, 2023, and will go into effect in Colorado, Utah and Connecticut later in 2023. Other jurisdictions where we operate have passed, or continue to propose, similar legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations. Our sales and operations are subject to the risks of doing business internationally, including in emerging markets. As we continue our expansion efforts in emerging markets around the world, through acquisitions and licensing transactions as well as through the development and introduction, both independently and through collaborations such as our collaboration with BeiGene, of our products in new markets, we face numerous risks to our business. There is no guarantee that our efforts and strategies to expand sales in emerging markets will succeed. Our international business, including in China and emerging market countries, may be especially vulnerable to periods of global and local political, legal, regulatory and financial instability, including issues of geopolitical relations, the imposition of international sanctions in response to certain state actions and/or sovereign debt issues. Further, in 2022 and continuing through early 2023, the Asia Pacific region also experienced a surge of COVID-19 infections. While one country in the region initially responded to the surge by activating strict containment measures, in late 2022 that country abruptly reversed those measures, resulting in a significant COVID-19 outbreak, causing issues such as lack of capacity at hospitals that could lead to a local health emergencies. If relations between the United States and other governments deteriorate, our business and investments in such markets may also be adversely affected. We may also be required to increase our reliance on third-party agents and unfamiliar operations and arrangements including those previously utilized by companies we partner with or acquire in emerging markets. See We must conduct clinical trials in humans before we commercialize and sell any of our product candidates or existing products for new indications. Our expansion efforts in China and emerging markets around the world are dependent upon the establishment of an environment that is predictable, navigable and supportive of biopharmaceutical innovation, sustained access for our products and predictable pricing controls. For example, China continues to strengthen regulations on the collection, use and transmission of Chinese human genetic resources, and has expanded regulations on the conduct of biotechnology R&D activities in China. Between 2020 and 2022, we experienced delays in our applications to the Human Genetic Resources Administration of China that sought approval to conduct clinical trials in China. Our international operations and business may also be subject to less protective intellectual property or other applicable laws, diverse data privacy and protection requirements, changing tax laws and tariffs, trade restrictions or other barriers designed to protect industry in the home country against foreign competition, far-reaching antibribery and anticorruption laws and regulations and/or evolving legal and regulatory environments. In response to the ongoing armed conflict in Ukraine, the U.S. government, numerous state governments, the EU and other countries in which we conduct business have imposed a wide range of economic sanctions that restrict commerce and business dealings with Russia, certain regions of Ukraine and certain entities and individuals. This conflict may also precipitate or amplify the other risks described herein, including risks relating to cybersecurity, global economic conditions, clinical trials and supply chains, which could adversely affect our business, operations and financial condition and results. As we expand internationally, we are subject to fluctuations in foreign currency exchange rates relative to the U.S. dollar. While we have a program in place that is designed to reduce our exposure to foreign currency exchange rate fluctuations through foreign currency hedging arrangements, our hedging efforts do not completely offset the effect of these fluctuations on our revenues and earnings. Overall, the legal and operational challenges of our international business operations, along with government controls, the challenges of attracting and retaining qualified personnel and obtaining and/or maintaining necessary regulatory or pricing approvals of our products, may result in material adverse effects on our international product sales, business and results of operations. 32 32 32

Global economic conditions may negatively affect us and may magnify certain risks that affect our business. Our operations and performance have been, and may continue to be, affected by global economic conditions. The economic downturn resulting from the COVID-19 pandemic precipitated a global recession, which was followed by high rates of inflation and actions taken by financial regulators to raise interest rates. Instability in the financial system, tighter lending standards and higher interest rates have added stress that may create additional vulnerabilities in the global economy, the effects of which may be of an extended duration. Additionally, with higher interest rates, deficits, and other fiscal pressures, governments may be unable to sustain their previously high levels of fiscal spending. Further, in the United States, although Congress has approved stopgap measures to fund the government through early March, the federal government continues to be at risk of a shutdown if legislation providing funding for the fiscal year is not passed as a result of political divisions in Congress and an impasse on budgetary and spending matters. Consequently, these and other financial pressures have caused, and may continue to cause, government or other third-party payers to more aggressively seek cost containment measures in healthcare and other settings. See Our sales depend on coverage and reimbursement from government and commercial third-party payers, and pricing and reimbursement pressures have affected, and are likely to continue to affect, our profitability. As a result of global economic conditions, some third-party payers may delay or be unable to satisfy their reimbursement obligations. Job losses or other economic hardships (including inflation) may also affect patients’ ability to afford healthcare as a result of increased co-pay or deductible obligations, greater cost sensitivity to existing co-pay or deductible obligations, lost healthcare insurance coverage or for other reasons. We believe such conditions have led and could continue to lead to reduced demand for our products, which could have a material adverse effect on our product sales, business and results of operations. The current inflationary environment related to increased aggregate demand, supply chain constraints and the effects from the armed conflict in Ukraine (including the effects of the sanctions that were implemented in response to the conflict and the resulting impacts on the commodity market and supply chains) and the Middle East have also increased our operating expenses and may continue to affect our operating expenses. Our operational costs, including the cost of energy, materials, labor, distribution and our other operational and facilities costs are subject to market conditions and are being adversely affected by inflationary pressures. Economic conditions may also adversely affect the ability of our distributors, customers and suppliers to 52 52 52 obtain the liquidity required to buy inventory or raw materials and to perform their obligations under agreements with us, which could disrupt our operations. Although we monitor our distributors’, customers’ and suppliers’ financial condition and their liquidity to mitigate our business risks, some of our distributors, customers and suppliers may become insolvent, which could have a material adverse effect on our product sales, business and results of operations. A significant worsening of global economic conditions could precipitate or materially amplify the other risks described herein. We maintain a significant portfolio of investments disclosed as cash equivalents and marketable securities on our consolidated balance sheets. In recent years, the global COVID-19 pandemic and interest rate increases have led to disruption and volatility in the global capital markets. We have certain assets, including equity investments, that are exposed to market fluctuations that could, in a sustained or recurrent series of market disruptions, result in impairments. The value of our investments may also be adversely affected by interest rate fluctuations, inflation, downgrades in credit ratings, illiquidity in the capital markets, geopolitical events and other factors that may result in other-than-temporary declines in the value of our investments. Any of those events could cause us to record impairment charges with respect to our investment portfolio or to realize losses on sales of investments. We also maintain a majority of our cash and cash equivalents in accounts with major multi-national financial institutions, and our deposits at these institutions exceed insured limits. Market conditions can adversely affect the viability of these institutions. In the event of failure of any of the financial institutions where we maintain our cash and cash equivalents, there can be no assurance that we would be able to access uninsured funds in a timely manner or at all. Inability to access, or a delay in accessing these funds, could adversely affect our business and financial position. Our stock price is volatile. Our stock price, like that of our peers in the biotechnology and pharmaceutical industries, is volatile. Our revenues and operating results may fluctuate from period to period for a number of reasons. Events such as a delay in product development, changes to our expectations or strategy or even a relatively small revenue shortfall may cause financial results for a period to be below our expectations or projections. As a result, our revenues and operating results and, in turn, our stock price may be subject to significant fluctuations. Announcements or discussions, including via social media channels, of possible restrictive actions by government or private payers that would negatively affect our business or industry if ultimately enacted or adopted may also cause our stock price to fluctuate, whether or not such restrictive actions ever actually occur. Similarly, actual or perceived safety issues with our products or similar products or unexpected clinical trial results can have an immediate and rapid effect on our stock price, whether or not our operating results are materially affected. 53 53 53

Global economic conditions may negatively affect us and may magnify certain risks that affect our business. Our operations and performance have been, and may continue to be, affected by global economic conditions. The economic downturn resulting from the COVID-19 pandemic precipitated a global recession, and together with high rates of inflation and energy supply issues experienced in certain regions, have led to regional and/or global macroeconomic challenges, the effects of which may be of an extended duration. In particular, acute rising energy costs may further adversely affect productivity and economic conditions in Europe. Additionally, financial pressures may cause government or other third-party payers to more aggressively seek cost containment measures in healthcare and other settings. See Our sales depend on coverage and reimbursement from government and commercial third-party payers, and pricing and reimbursement pressures have affected, and are likely to continue to affect, our profitability. As a result of global economic conditions, some third-party payers may delay or be unable to satisfy their reimbursement obligations. Job losses or other economic hardships (including inflation) may also affect patients’ ability to afford healthcare as a result of increased co-pay or deductible obligations, greater cost sensitivity to existing co-pay or deductible obligations, lost healthcare insurance coverage or for other reasons. We believe such conditions have led and could continue to lead to reduced demand for our products, which could have a material adverse effect on our product sales, business and results of operations. The current inflationary environment related to increased aggregate demand, supply chain constraints and the effects from the armed conflict in Ukraine (including the effects of the sanctions that were implemented in response to the conflict and the resulting impacts on the commodity market and supply chains) have also increased our operating expenses and may continue to affect our operating expenses. Our operational costs, including the cost of energy, materials, labor, distribution and our other operational and facilities costs are subject to market conditions and are being adversely affected by inflationary pressures. Economic conditions may also adversely affect the ability of our distributors, customers and suppliers to obtain the liquidity required to buy inventory or raw materials and to perform their obligations under agreements with us, which could disrupt our operations. Although we monitor our distributors’, customers’ and suppliers’ financial condition and their liquidity to mitigate our business risks, some of our distributors, customers and suppliers may become insolvent, which could have a material adverse effect on our product sales, business and results of operations. A significant worsening of global economic conditions could precipitate or materially amplify the other risks described herein. We maintain a significant portfolio of investments disclosed as cash equivalents and marketable securities on our consolidated balance sheets. The global spread of COVID-19 has also led to disruption and volatility in the global capital markets. We have certain assets, including equity investments, that are exposed to market fluctuations that could, in a sustained 50 50 50 or recurrent series of market disruptions, result in impairments. The value of our investments may also be adversely affected by interest rate fluctuations, inflation, downgrades in credit ratings, illiquidity in the capital markets and other factors that may result in other-than-temporary declines in the value of our investments. Any of those events could cause us to record impairment charges with respect to our investment portfolio or to realize losses on sales of investments. Our stock price is volatile. Our stock price, like that of our peers in the biotechnology and pharmaceutical industries, is volatile. Our revenues and operating results may fluctuate from period to period for a number of reasons. Events such as a delay in product development, changes to our expectations or strategy or even a relatively small revenue shortfall may cause financial results for a period to be below our expectations or projections. As a result, our revenues and operating results and, in turn, our stock price may be subject to significant fluctuations. Announcements or discussions, including via social media channels, of possible restrictive actions by government or private payers that would negatively affect our business or industry if ultimately enacted or adopted may also cause our stock price to fluctuate, whether or not such restrictive actions ever actually occur. Similarly, actual or perceived safety issues with our products or similar products or unexpected clinical trial results can have an immediate and rapid effect on our stock price, whether or not our operating results are materially affected. We may not be able to access the capital and credit markets on terms that are favorable to us, or at all. The capital and credit markets may experience extreme volatility and disruption, which may lead to uncertainty and liquidity issues for both borrowers and investors. For example, early in 2020, there were significant disruptions in the commercial paper market and several borrowers were unable to obtain funding at normal rates or maturities, which resulted in a significant increase in draws of corporate credit lines with banks. Similarly, the bond markets experienced extreme volatility in terms of interest rates and credit spreads, with several days without new issuances of corporate bonds. We expect to access the capital markets, from time to time, to supplement our existing funds and cash generated from operations to satisfy our needs for working capital; capital expenditure and debt service requirements; our plans to pay dividends and repurchase stock; and other business initiatives we strategically plan to pursue, including acquisitions (such as our acquisition of Horizon) and licensing activities. In the event of adverse capital and credit market conditions, we may be unable to obtain capital market financing on similar favorable terms, or at all, which could have a material adverse effect on our business and results of operations or our ability to complete business acquisitions. Changes in credit ratings issued by nationally recognized credit-rating agencies could adversely affect our ability to obtain capital market financing and the cost of such financing and have an adverse effect on the market price of our securities.