McKesson Corporation: 10-K Risk Factor Changes

We, our external service providers, vendors, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite conducting our own physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including the adoption of sophisticated and rapidly evolving techniques, such as adversarial AI, and during political tensions, military conflicts, or civil unrest. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, and operations of our technology systems or data, which might result in harm to patients, consumers, or employees; litigation or regulatory action; disruption of our business operations; loss of customers or revenue; cash flow impacts; and increased expense. Any of these scenarios might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

We, our external service providers, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite physical, technical, and administrative security measures, technology systems and operations of the Company and third parties with which we do business are subject to cyberattacks and cybersecurity incidents. Cybersecurity incidents include unauthorized occurrences on or conducted through our information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk of cyberattacks increases from time to time due to a variety of internal and external factors, including during political tensions, military conflicts, or civil unrest. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, and operations of our technology systems or data, which might result in injury to patients or consumers, litigation or regulatory action, disruption of our business operations, loss of customers or revenue, and increased expense, any of which might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Failure to comply with these laws subjects us to potential regulatory enforcement activity, fines, private litigation including class actions, reputational impacts, and other costs. We also have contractual obligations that might be breached if we fail to comply with privacy and data security laws. Our efforts to comply with privacy and data security laws complicate our operations and add to our costs. A significant privacy breach or failure to comply with privacy and data security laws, by us or by external service providers, vendors, or other third parties with which we do business, might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Failure to comply with these laws subjects us to potential regulatory enforcement activity, fines, private litigation including class actions, reputational impacts, and other costs. We also have contractual obligations that might be breached if we fail to comply with privacy and data security laws. Our efforts to comply with privacy and data security laws complicate our operations and add to our costs. A significant privacy breach or failure to comply with privacy and data security laws might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We are subject to the tax laws in the U.S. at the federal, state, and local government levels and to the tax laws of other jurisdictions in which we operate or sell products or services. Tax laws might change in ways that adversely affect our tax positions, effective tax rate, and cash flow. The tax laws are extremely complex and subject to varying interpretations. For example, the European Union and other countries (including countries in which we operate) have committed to enacting changes to numerous long-standing tax principles impacting how large multinational enterprises are taxed. In particular, the Organization for Economic Cooperation and Development’s Pillar Two initiative introduces a 15% global minimum tax applied on a country-by-country basis which many jurisdictions have now committed to enact. The impact of these potential new regulations as well as any other changes in domestic and international tax regulations could have a material effect on our effective tax rate. We are subject to tax examinations in various jurisdictions that might assess additional tax liabilities against us. Our tax reporting positions are sometimes challenged by relevant tax authorities, we might incur significant expense in our efforts to defend those challenges, and we might be unsuccessful in those efforts. Developments in examinations and challenges might materially change our provision for taxes in the affected periods and might differ materially from our historical tax accruals. Any of these risks might have a materially adverse impact on our business operations, our cash flows, and our financial position or results of operations.

We are subject to the tax laws in the U.S. at the federal, state, and local government levels and to the tax laws of other jurisdictions in which we operate or sell products or services. Tax laws might change in ways that adversely affect our tax positions, effective tax rate, and cash flow. The tax laws are extremely complex and subject to varying interpretations. We are subject to tax examinations in various jurisdictions that might assess additional tax liabilities against us. Our tax reporting positions are sometimes challenged by relevant tax authorities, we might incur significant expense in our efforts to defend those challenges, and we might be unsuccessful in those efforts. Developments in examinations and challenges might materially change our provision for taxes in the affected periods and might differ materially from our historical tax accruals. Any of these risks might have a materially adverse impact on our business operations, our cash flows, and our financial position or results of operations. 23 23 23 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our business strategy as a diversified healthcare services company includes investing to build an integrated oncology service business and expand our biopharma services business. Our ability to grow those businesses will depend on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities; forming and expanding business relationships; and successfully competing against providers of similar services. New technologies may not result in the benefits we anticipate or enable us to maintain a competitive advantage. AI technology is continuously evolving, and the AI technologies we employ may become obsolete earlier than planned. Additionally, some historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. We may not achieve our desired return on our investments through our growth strategies. If we fail to achieve acceptable sales and profitability in our strategic growth areas, it might have a materially adverse impact on our business prospects and our financial position or results of operations.

Our business strategy as a diversified healthcare services company includes investing to build an integrated oncology service business and expand our biopharma services business. Our ability to grow those businesses will depend on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities; forming and expanding business relationships; and successfully competing against providers of similar services. Some competitors have more experience than we do in enabling technologies such as data analytics. We may not achieve our desired return on our investments through our growth strategies. If we fail to achieve acceptable sales and profitability in our strategic growth areas, it might have a materially adverse impact on our business prospects and our financial position or results of operations.

Our ability to attract, engage, develop, and retain qualified and experienced employees, including key executives and other talent, is essential for us to meet our objectives. We compete with many other businesses to attract and retain employees. Competition among potential employers results in increased salaries, benefits, or other employee-related costs, or in our failure to recruit and retain employees. We may experience sudden loss of key personnel due to a variety of causes, such as illness, and must adequately plan for succession of key management roles. Employees might not successfully transition into new roles. Separately, there is increased scrutiny on companies’ diversity, equity, and inclusion (“DEI”) initiatives. Negative perception of our DEI initiatives, whether due to our perceived over or under pursuit of such initiatives, may likewise result in issues hiring or retaining employees, as well as potential litigation or other adverse impacts. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations. 20 20 20 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our ability to attract, engage, develop, and retain qualified and experienced employees, including key executives and other talent, is essential for us to meet our objectives. We compete with many other businesses to attract and retain employees. Competition among potential employers results in increased salaries, benefits, or other employee-related costs, or in our failure to recruit and retain employees. We may experience sudden loss of key personnel due to a variety of causes, such as illness, and must adequately plan for succession of key management roles. Employees might not successfully transition into new roles. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to the operating, quality, regulatory, and security requirements of the DEA, the FDA, various state boards of pharmacy, state health departments, the CMS, and other comparable agencies. Noncompliance with these requirements can result in inspectional observations, warning letters, product recalls, seizures, injunctions, and other administrative, civil, and criminal enforcement actions. Noncompliance, enforcement actions, or adverse decisions by regulators, or the inability to obtain, maintain, or renew permits, licenses, or other regulatory approvals needed for the operation of our businesses might have a materially adverse impact on our business operations and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to the operating and security standards of the DEA, the FDA, various state boards of pharmacy, state health departments, the CMS, and other comparable agencies. Noncompliance with these requirements results in monetary penalties and/or licensing sanctions. Any inability to obtain, maintain, or renew permits, licenses, or other regulatory approvals needed for the operation of our businesses might have a materially adverse impact on our business operations and our financial position or results of operations.

Many of our products and services are designed and intended to function within the structure of current healthcare financing and reimbursement systems. The healthcare industry and related government programs are changing. Some of these changes increase our risks and create uncertainties for our business. For example, some changes in reimbursement methodologies (including government rates) for pharmaceuticals, medical treatments, and related services reduce profit margins for us and our customers and impose new legal requirements on healthcare providers. Those changes have included cuts in Medicare and Medicaid reimbursement levels, changes in the basis for payments, shifts from fee-for-service pricing towards value-based payments and risk-sharing models, and increases in the use of managed care. In the U.S., the ACA significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. Enactment of the IRA and its implementation over the next several years is anticipated to bring meaningful changes in how Medicare pays for drugs and various benefit design changes, which are all intended to reduce the price of drugs. Three central features of the IRA would authorize the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflationary rebate program, and cap patient cost sharing under Medicare Part D. The implementation of these and other features of the IRA may result in significant changes to the pharmaceutical value chain as manufacturers, pharmacy benefit managers, managed care organizations, and other industry stakeholders look to implement new transactional flows and adapt their business models. Any such changes to arrangements involving our business as a result of this legislation, such as changes to our distribution agreements with manufacturers impacted by the IRA, may materially affect our business. The extent of the effects of the IRA remains uncertain due to a number of factors, including the potential for future regulations and guidance promulgated by HHS to implement provisions of the IRA. We continue to evaluate the impact of this law on our business. Private challenges to government healthcare policy may also have significant impacts on our business. For example, many pharmaceutical manufacturers have unilaterally restricted sales under the 340B drug pricing program to contract pharmacies. The 340B drug pricing program requires manufacturers to offer discounts on certain drugs purchased by “covered entities,” which include safety-net providers. The Health Resources and Services Administration has taken the position that a covered entity may dispense such discounted drugs through multiple contract pharmacies. Starting in 2020, some manufacturers began to restrict such practices. Some manufacturers and HHS continue to litigate these issues. The U.S. Court of Appeals for the Third Circuit has ruled that Section 340B does not require manufacturers to provide discounted drugs to an unlimited number of contract pharmacies. Two other courts of appeal are addressing this issue but have not yet ruled. Any changes to our arrangements that result from the rulings in these cases might have an adverse impact on our business. Provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, provincial governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic manufacturers. Although there is substantial uncertainty about the likelihood, timing, and results of these health reform efforts, their implementation might have a materially adverse impact on our business operations and our financial position or results of operations. 21 21 21 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Many of our products and services are designed and intended to function within the structure of current healthcare financing and reimbursement systems. The healthcare industry and related government programs are changing. Some of these changes increase our risks and create uncertainties for our business. For example, some changes in reimbursement methodologies (including government rates) for pharmaceuticals, medical treatments, and related services reduce profit margins for us and our customers and impose new legal requirements on healthcare providers. Those changes have included cuts in Medicare and Medicaid reimbursement levels, changes in the basis for payments, shifts from fee-for-service pricing towards value-based payments and risk-sharing models, and increases in the use of managed care. In the U.S., the ACA significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payers. Enactment of the IR Act and its implementation over the next several years is anticipated to bring meaningful changes in how Medicare pays for drugs and various benefit design changes, which are all intended to reduce the price of drugs. Three central features of the IR Act would authorize the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflationary rebate program, and cap patient cost sharing under Medicare. The implementation of these and other features of the IR Act may result in significant changes to the pharmaceutical value chain as manufacturers, pharmacy benefit managers, managed care organizations, and other industry stakeholders look to implement new transactional flows and adapt their business models. Any such changes to arrangements involving our business as a result of this legislation, such as changes to our distribution agreements with manufacturers impacted by the IR Act, may materially affect our business. The extent of the effects of the IR Act remains uncertain due to a number of factors, including the potential for future regulations promulgated by the HHS to implement provisions of the IR Act. We continue to evaluate the impact of this law on our business. Private challenges to government healthcare policy may also have significant impacts on our business. For example, over a dozen pharmaceutical manufacturers have unilaterally restricted sales under the 340B drug pricing program to contract pharmacies. The 340B drug pricing program requires manufacturers to offer discounts on certain drugs purchased by “covered entities,” which include safety-net providers. The Health Resources and Services Administration has taken the position that a covered entity may dispense such discounted drugs through multiple contract pharmacies. Starting in 2020, some manufacturers began to restrict such practices. Some manufacturers and the HHS continue to litigate these issues. The U.S. Court of Appeals for the Third Circuit has ruled that Section 340B does not require discounts for an unlimited number of contract pharmacies. Two other courts of appeal are addressing this issue but have not yet ruled. 21 21 21 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Some of our customers from time to time reduce the amounts they purchase from us, do not renew their purchase contracts with us, delay or default on their payments to us, or avoid payments to us through bankruptcy proceedings. At March 31, 2024, sales to our largest customer represented approximately 28% of our total consolidated revenues and approximately 24% of our total trade receivables, and those of our ten largest customers combined accounted for approximately 69% of our consolidated revenues and approximately 43% of our trade receivables. Refer to “Other Information about the Business” in Item 1 of Part I above for additional details on our customers. One or more customer purchase reductions, contract non-renewals, payment defaults, or bankruptcies might have a materially adverse impact on our business operations and our financial position or results of operations.

We derive a significant portion of our revenue from, and have a significant portion of our accounts receivable with, a small number of customers. At March 31, 2023, sales to our largest customer represented approximately 27% of our total consolidated revenues and approximately 21% of our total trade receivables, and those of our ten largest customers combined accounted for approximately 68% of our consolidated revenues and approximately 42% of our trade receivables. Refer to “Other Information about the Business” in Item 1 of Part I above for additional details on our customers. A material default in payment, reduction in purchases, or the loss of business from a large customer might have a materially adverse impact on our business operations and our financial position or results of operations. 19 19 19 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index