McKesson Corporation: 10-K Risk Factor Changes

We, our external service providers, vendors, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite our physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business, have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Companies in the healthcare industry are increasingly targeted for cyberattacks. Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including, but not limited to, the adoption of sophisticated and rapidly evolving techniques, such as adversarial AI, and during political or military unrest. Our adoption of AI also may create new attack surfaces or methods and generally increase cybersecurity and data protection risks and costs. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, and operations of our technology systems or data, which might result in harm to patients, consumers, or employees; litigation or regulatory action; disruption of our business operations; loss of customers or revenue; cash flow impacts; and increased expense. Additionally, it may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full, and reliable information about the incident to our customers, regulators, and the public. Any cybersecurity incident might have a materially adverse impact on our business, our operations, our reputation, and our financial position or results of operations.

We, our external service providers, vendors, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite conducting our own physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including the adoption of sophisticated and rapidly evolving techniques, such as adversarial AI, and during political tensions, military conflicts, or civil unrest. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, and operations of our technology systems or data, which might result in harm to patients, consumers, or employees; litigation or regulatory action; disruption of our business operations; loss of customers or revenue; cash flow impacts; and increased expense. Any of these scenarios might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

SectionPageLitigation and Regulatory Risks13Company and Operational Risks 16Industry and Economic Risks20General Risks23 Litigation and Regulatory Risks 13 Company and Operational Risks 16 Industry and Economic Risks 20 General Risks 23 The discussion below identifies certain representative risks that might cause our actual business results to materially differ from our estimates. It is not practical to identify or describe all risks and uncertainties that might materially impact our business operations, reputation, financial position, or results of operations. Our business could be materially affected by risks that we have not yet identified or that we currently consider to be immaterial. This is not a complete discussion of all potential risks and uncertainties.

SectionPageLitigation and Regulatory Risks14Company and Operational Risks 16Industry and Economic Risks21General Risks24 Litigation and Regulatory Risks 14 Company and Operational Risks 16 Industry and Economic Risks 21 General Risks 24 The discussion below identifies certain representative risks that might cause our actual business results to materially differ from our estimates. It is not practical to identify or describe all risks and uncertainties that might materially impact our business operations, reputation, financial position, or results of operations. Our business could be materially affected by risks that we have not yet identified or that we currently consider to be immaterial. This is not a complete discussion of all potential risks and uncertainties.

Our business strategy as a diversified healthcare services company includes investing to build an integrated oncology and specialty care platform and expand our biopharma services business. Our ability to grow those businesses will depend on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities, including AI; forming and expanding business relationships; and successfully competing against providers of similar services. New technologies, such as AI, may not result in the benefits we anticipate, may not enable us to maintain a competitive advantage, and may require us to expend significant resources. We have increased, and expect to continue to increase, our use of AI technology. The AI technologies we employ may become obsolete earlier than planned or we may be unsuccessful at realizing the benefits of these investments. Additionally, some of our historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. We may not achieve our desired return on our investments through our growth strategies. If we fail to achieve acceptable sales and profitability in our strategic growth areas, it might have a materially adverse impact on our business prospects and our financial position or results of operations.

Our business strategy as a diversified healthcare services company includes investing to build an integrated oncology service business and expand our biopharma services business. Our ability to grow those businesses will depend on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities; forming and expanding business relationships; and successfully competing against providers of similar services. New technologies may not result in the benefits we anticipate or enable us to maintain a competitive advantage. AI technology is continuously evolving, and the AI technologies we employ may become obsolete earlier than planned. Additionally, some historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. We may not achieve our desired return on our investments through our growth strategies. If we fail to achieve acceptable sales and profitability in our strategic growth areas, it might have a materially adverse impact on our business prospects and our financial position or results of operations.

Our generic pharmaceuticals distribution business is subject to both product availability and pricing risks. We might experience disruptions in our supply of generic pharmaceuticals. We have been impacted when, due to regulatory and supply chain challenges, our supplier partners are not able to deliver products that we have committed to source from them. Input cost increases, product discontinuations, and market shortages could result in ClarusONE, our joint venture with Walmart Inc., being unsuccessful in sourcing product to meet the needs of our customers, or could negatively impact our margin. Generic drug manufacturers offer a generic version of branded pharmaceuticals and routinely challenge the validity or enforceability of branded pharmaceutical patents in order to launch the drug pre- or post-loss of exclusivity. Patent holders have asserted infringement claims against us for distributing those generic versions they believed to have infringed a patent, and the generic drug manufacturers may not fully indemnify us against such claims. These risks and outcomes, as well as changes in the nature, frequency, or magnitude of generic pharmaceutical launches, might have a materially adverse impact on our business operations and our financial position or results of operations.

Our generic pharmaceuticals distribution business is subject to both availability and pricing risks. We might experience disruptions in our supply of higher margin pharmaceuticals, including generic pharmaceuticals. We have been impacted when, due to regulatory and supply chain challenges, our supplier partners are not able to deliver products that we have committed to purchase and source from them. Input cost increases and market shortages could result in ClarusONE, our joint venture with Walmart Inc., being unsuccessful in sourcing product to meet the needs of our customers, or negatively impacting our margin. Generic drug manufacturers offer a generic version of branded pharmaceuticals and routinely challenge the validity or enforceability of branded pharmaceutical patents in order to launch the drug pre- or post-loss of exclusivity. Patent holders have asserted infringement claims against us for distributing those generic versions they believed to have infringed a patent, and the generic drug manufactures may not fully indemnify us against such claims. These risks and outcomes, as well as changes in the availability, pricing volatility, regulatory, or significant changes in the nature, frequency, or magnitude of generic pharmaceutical launches, might have a materially adverse impact on our business operations and our financial position or results of operations. 22 22 22 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

When we decide to sell or otherwise divest assets or a business, we may encounter difficulty in finding buyers or exit strategies on acceptable terms or in a timely manner, which could delay the achievement of our strategic objectives. After the disposition, we might experience greater dissynergies than expected, and the impact of the divestiture on our revenue or profit might be larger than we expected. We might have difficulties with pre-closing conditions such as governmental approvals, which could delay or prevent the divestiture. We might have financial exposure in a divested business, such as through minority equity ownership, financial or performance guarantees, indemnities, or other obligations, such that conditions outside of our control might negate the expected benefits of the disposition. Any of these risks could adversely affect our ability to achieve the anticipated benefits of a divestiture and might have a materially adverse impact on our business operations and our financial position or results of operations.

When we decide to sell assets or a business, we may encounter difficulty in finding buyers or exit strategies on acceptable terms or in a timely manner, which could delay the achievement of our strategic objectives. After the disposition, we might experience greater dissynergies than expected, and the impact of the divestiture on our revenue or profit might be larger than we expected. We might have difficulties with pre-closing conditions such as regulatory and governmental approvals, which could delay or prevent the divestiture. We might have financial exposure in a divested business, such as through minority equity ownership, financial or performance guarantees, indemnities, or other obligations, such that conditions outside of our control might negate the expected benefits of the disposition. Any of these risks could adversely affect our ability to achieve the anticipated benefits of a divestiture and might have a materially adverse impact on our business operations and our financial position or results of operations.

Our contracts with governmental entities are subject to risks such as lack of funding and compliance with unique requirements. For example, government contract purchase obligations are typically subject to the availability of funding, which may be eliminated or reduced. In addition, the future volume of products or services purchased by a government customer is often uncertain. Our government contracts might not be renewed or might be terminated for convenience with little prior notice. They might be modified with less favorable terms. Government contracts typically expose us to higher potential liability than do other types of contracts. In addition, government contracts typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. For example, our contracts with the U.S. government generally require us to comply with the Federal Acquisition Regulation, Procurement Integrity Act, Buy American Act, Trade Agreements Act, and other laws and requirements. New or revised laws, requirements, and policies, or changes in the interpretation of existing laws, requirements, and policies, could adversely affect our business and competitiveness and increase our compliance costs. We are subject to government audits, investigations, and oversight proceedings. Governmental agencies routinely review and audit government contractors to determine whether they are complying with contractual and legal requirements. If we fail to comply with these requirements, or we fail an audit, we may be subject to various sanctions such as monetary damages, criminal and civil penalties, termination of contracts, and suspension or debarment from government contract work. These requirements complicate our business and increase our compliance burden. The occurrence of any of these risks could harm our reputation and might have a materially adverse impact on our business operations and our financial position or results of operations. 19 19 19 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our contracts with government entities are subject to risks such as lack of funding and compliance with unique requirements. For example, government contract purchase obligations are typically subject to the availability of funding, which may be eliminated or reduced. In addition, the future volume of products or services purchased by a government customer is often uncertain. Our government contracts might not be renewed or might be terminated for convenience with little prior notice. Government contracts typically expose us to higher potential liability than do other types of contracts. In addition, government contracts typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. For example, our contracts with the U.S. government generally require us to comply with the Federal Acquisition Regulations, Procurement Integrity Act, Buy American Act, Trade Agreements Act, and other laws and regulations. We are subject to government audits, investigations, and oversight proceedings. Government agencies routinely review and audit government contractors to determine whether they are complying with contractual and legal requirements. If we fail to comply with these requirements, or we fail an audit, we may be subject to various sanctions such as monetary damages, criminal and civil penalties, termination of contracts, and suspension or debarment from government contract work. These requirements complicate our business and increase our compliance burden. The occurrence of any of these risks could harm our reputation and might have a materially adverse impact on our business operations and our financial position or results of operations. 19 19 19 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We distribute pharmaceutical, medical, and other FDA-regulated products manufactured by third parties and by our private label businesses, including medications that may be temperature sensitive or have limited shelf lives. Our systems and procedures are designed to maintain the safety and efficacy of the products throughout the sourcing and distribution process. Issues affecting product safety or efficacy can arise from manufacturing, storing, distributing, dispensing or using products, and can result in adverse consequences such as safety alerts, seizures, bans, recalls, withdrawals or other market action, suspensions, and other regulatory actions and sanctions, civil lawsuits, increased costs, disruptions, delays, and reputational damage. Any of these types of issues or results might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We distribute pharmaceutical, medical, and other FDA-regulated products manufactured by third parties and by our private label businesses, including medications that may be temperature sensitive and have limited shelf lives. Our systems and procedures are designed to maintain the safety and efficacy of the products throughout the sourcing and distribution process. Issues affecting product efficacy or safety can arise from manufacturing, storing, distributing, dispensing or using products, and can result in safety alerts, recalls, regulatory action, civil lawsuits, fines or other sanctions, and reputational damage. Any of these types of issues or results might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations. 17 17 17 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our ability to attract, engage, develop, and retain qualified and experienced employees, including key executives and other talent, is essential for us to meet our objectives. We compete with many other businesses to attract and retain employees. Competition among potential employers results in increased salaries, benefits, or other employee-related costs, or in our failure to recruit and retain employees. We may experience sudden loss of key personnel due to a variety of causes, such as illness; and although we must adequately plan for timely succession of key management roles, our succession plans might not be effective, and employees might not successfully transition into new roles. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

Our ability to attract, engage, develop, and retain qualified and experienced employees, including key executives and other talent, is essential for us to meet our objectives. We compete with many other businesses to attract and retain employees. Competition among potential employers results in increased salaries, benefits, or other employee-related costs, or in our failure to recruit and retain employees. We may experience sudden loss of key personnel due to a variety of causes, such as illness, and must adequately plan for succession of key management roles. Employees might not successfully transition into new roles. Separately, there is increased scrutiny on companies’ diversity, equity, and inclusion (“DEI”) initiatives. Negative perception of our DEI initiatives, whether due to our perceived over or under pursuit of such initiatives, may likewise result in issues hiring or retaining employees, as well as potential litigation or other adverse impacts. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations. 20 20 20 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

In the U.S., the ACA significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. Enactment of the IRA and its implementation over the next several years is anticipated to bring meaningful changes in how Medicare pays for drugs and various benefit design changes, which are all intended to reduce the price of drugs. Three central features of the IRA authorize the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflationary rebate program, and cap patient cost sharing under Medicare Part D. The implementation of these and other features of the IRA may result in significant changes to the pharmaceutical value chain as manufacturers, pharmacy benefit managers, managed care organizations, and other industry stakeholders look to implement new transactional flows and adapt their business models. Any such changes to arrangements involving our business as a result of this legislation, such as changes to our distribution agreements with manufacturers impacted by the IRA, may materially affect our business. The extent of the effects of the IRA remains uncertain due to a number of factors, including the potential for future regulations and guidance promulgated by HHS to implement provisions of the IRA. We continue to evaluate the impact of this law on our business. Private challenges to government healthcare policy may also have significant impacts on our business. For example, many pharmaceutical manufacturers have unilaterally restricted sales under the Public Health Service’s 340B Drug Pricing Program (the “340B program”) to contract pharmacies. The 340B program requires manufacturers to offer discounts on certain drugs purchased by “covered entities,” which include safety-net providers. The Health Resources and Services Administration (“HRSA”) has taken the position that a covered entity may dispense such discounted drugs through multiple contract pharmacies. Starting in 2020, some manufacturers began to restrict such practices. Certain manufacturers and HHS continue to litigate these issues. The U.S. Courts of Appeal for the Third and D.C. Circuits have ruled that Section 340B of the Public Health Service Act does not require manufacturers to provide discounted drugs to an unlimited number of contract pharmacies. The U.S. Court of Appeals for the Seventh Circuit also is addressing this issue but has not yet ruled. Separately, several entities have filed lawsuits against HHS and HRSA related to the proposed implementation of rebate models to effectuate 340B pricing. Any changes to our arrangements that result from the rulings in these cases might have an adverse impact on our business. Provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, provincial governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic manufacturers. Although there is substantial uncertainty about the likelihood, timing, and results of these health reform efforts and challenges, their implementation or outcome might have a materially adverse impact on our business operations and our financial position or results of operations.

Many of our products and services are designed and intended to function within the structure of current healthcare financing and reimbursement systems. The healthcare industry and related government programs are changing. Some of these changes increase our risks and create uncertainties for our business. For example, some changes in reimbursement methodologies (including government rates) for pharmaceuticals, medical treatments, and related services reduce profit margins for us and our customers and impose new legal requirements on healthcare providers. Those changes have included cuts in Medicare and Medicaid reimbursement levels, changes in the basis for payments, shifts from fee-for-service pricing towards value-based payments and risk-sharing models, and increases in the use of managed care. In the U.S., the ACA significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. Enactment of the IRA and its implementation over the next several years is anticipated to bring meaningful changes in how Medicare pays for drugs and various benefit design changes, which are all intended to reduce the price of drugs. Three central features of the IRA would authorize the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflationary rebate program, and cap patient cost sharing under Medicare Part D. The implementation of these and other features of the IRA may result in significant changes to the pharmaceutical value chain as manufacturers, pharmacy benefit managers, managed care organizations, and other industry stakeholders look to implement new transactional flows and adapt their business models. Any such changes to arrangements involving our business as a result of this legislation, such as changes to our distribution agreements with manufacturers impacted by the IRA, may materially affect our business. The extent of the effects of the IRA remains uncertain due to a number of factors, including the potential for future regulations and guidance promulgated by HHS to implement provisions of the IRA. We continue to evaluate the impact of this law on our business. Private challenges to government healthcare policy may also have significant impacts on our business. For example, many pharmaceutical manufacturers have unilaterally restricted sales under the 340B drug pricing program to contract pharmacies. The 340B drug pricing program requires manufacturers to offer discounts on certain drugs purchased by “covered entities,” which include safety-net providers. The Health Resources and Services Administration has taken the position that a covered entity may dispense such discounted drugs through multiple contract pharmacies. Starting in 2020, some manufacturers began to restrict such practices. Some manufacturers and HHS continue to litigate these issues. The U.S. Court of Appeals for the Third Circuit has ruled that Section 340B does not require manufacturers to provide discounted drugs to an unlimited number of contract pharmacies. Two other courts of appeal are addressing this issue but have not yet ruled. Any changes to our arrangements that result from the rulings in these cases might have an adverse impact on our business. Provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, provincial governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic manufacturers. Although there is substantial uncertainty about the likelihood, timing, and results of these health reform efforts, their implementation might have a materially adverse impact on our business operations and our financial position or results of operations. 21 21 21 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our growth strategy includes consummating acquisitions or other strategic transactions that either expand or complement our business. To fund these strategic transactions, we may require financing that may not be available on acceptable terms. We may not receive governmental approvals needed to complete proposed transactions, or such approvals may be subject to delays or conditions that reduce transaction benefits. Achieving the desired outcomes of these strategic transactions involves significant risks including: diverting management’s attention from other business operations; challenges with assimilating the acquired businesses, such as integration of operations, systems, and technologies; failure or delay in realizing operating synergies; difficulty retaining key acquired company personnel; unanticipated accounting or financial systems issues with the acquired business, which might affect our internal controls over financial reporting; disputes with the sellers of acquired businesses; unanticipated compliance issues in the acquired business; unknown or unanticipated cybersecurity issues; challenges retaining customers of the acquired business; unanticipated expenses or charges to earnings, including depreciation and amortization or potential impairment charges; and risks of known and unknown assumed liabilities in the acquired business. These risks at times have adversely affected, and could in the future adversely affect, our ability to achieve the anticipated benefits of an acquisition, and might have a materially adverse impact on our business operations and our financial position or results of operations. 17 17 17 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

Our growth strategy includes consummating acquisitions or other business combinations that either expand or complement our business. To fund acquisitions, we may require financing that may not be available on acceptable terms. We may not receive regulatory approvals needed to complete proposed transactions, or such approvals may be subject to delays or conditions that reduce transaction benefits. Achieving the desired outcomes of business combinations involves significant risks including: diverting management’s attention from other business operations; challenges with assimilating the acquired businesses, such as integration of operations, systems, and technologies; failure or delay in realizing operating synergies; difficulty retaining key acquired company personnel; unanticipated accounting or financial systems issues with the acquired business, which might affect our internal controls over financial reporting; unanticipated compliance issues in the acquired business; unknown or unanticipated cybersecurity issues; challenges retaining customers of the acquired business; unanticipated expenses or charges to earnings, including depreciation and amortization or potential impairment charges; and risks of known and unknown assumed liabilities in the acquired business. Any of these risks could adversely affect our ability to achieve the anticipated benefits of an acquisition and might have a materially adverse impact on our business operations and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy, cybersecurity, data protection, and AI laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Failure to comply with these laws subjects us to potential regulatory enforcement activity, fines, private litigation including class actions, reputational impacts, and other costs. We also have contractual obligations that might be breached if we fail to comply with privacy and data security laws. The use of AI solutions by our employees or third parties on which we rely could also lead to the misuse of data or public disclosure of confidential information (including personal data or proprietary information) in contravention of our internal policies, applicable laws, contractual requirements, or third-party intellectual property rights. Our efforts to comply with privacy, data security, and AI laws complicate our operations and add to our costs. A significant cybersecurity and/or privacy breach or failure to comply with privacy and data security laws, by us or by external service providers, vendors, or other third parties with which we do business, might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Failure to comply with these laws subjects us to potential regulatory enforcement activity, fines, private litigation including class actions, reputational impacts, and other costs. We also have contractual obligations that might be breached if we fail to comply with privacy and data security laws. Our efforts to comply with privacy and data security laws complicate our operations and add to our costs. A significant privacy breach or failure to comply with privacy and data security laws, by us or by external service providers, vendors, or other third parties with which we do business, might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to the operating, quality, regulatory, and security requirements of the DEA, the FDA, various state boards of pharmacy, state health departments, CMS, and other agencies. Noncompliance with these requirements can result in inspectional observations, warning letters, product recalls, withdrawals or other market action, fines, seizures, injunctions, and other administrative, civil, and criminal enforcement actions. Noncompliance, enforcement actions or adverse decisions by regulators, or the inability to obtain, maintain, or renew permits, licenses, or other regulatory approvals needed for the operation of our businesses might have a materially adverse impact on our reputation, our business operations and our financial position or results of operations.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to the operating, quality, regulatory, and security requirements of the DEA, the FDA, various state boards of pharmacy, state health departments, the CMS, and other comparable agencies. Noncompliance with these requirements can result in inspectional observations, warning letters, product recalls, seizures, injunctions, and other administrative, civil, and criminal enforcement actions. Noncompliance, enforcement actions, or adverse decisions by regulators, or the inability to obtain, maintain, or renew permits, licenses, or other regulatory approvals needed for the operation of our businesses might have a materially adverse impact on our business operations and our financial position or results of operations.

Inflationary conditions result in increased costs associated with our normal business operations and decreased levels of consumer commercial spending and, to the extent we are not able to offset such cost increases from our suppliers, increase the costs which we incur to purchase inventories and services. Inflationary pressure is increased by factors such as supply chain disruptions, labor market tightness, actual or announced tariffs, government policies, interest rate changes, and foreign exchange rate changes. An economic slowdown or a recession could also reduce the prices our customers are able or willing to pay for our products and services and reduce the volume of their purchases. In addition to rising inflation, rising interest rates, the impact of banking failures or perceived failures and related contagion, consumer sentiment, political circumstances, military conflicts, and civil unrest may contribute to recessionary pressure. Our non-U.S. operations, import and export of products sold in non-U.S. dollar (USD) denominations, non-USD intercompany loans, and our substantial international net assets also expose us to foreign currency exchange rate risk. Changes in the economic environments in which we operate might have a materially adverse impact on our business operations and our financial position or results of operations.

Inflationary conditions result in increased transportation, operational, and other administrative costs associated with our normal business operations and decreased levels of consumer commercial spending and, to the extent we are not able to offset such cost increases from our suppliers, increase the costs which we incur to purchase inventories and services. Inflationary pressure is increased by factors such as supply chain disruptions, including the reduced availability of key commodities, labor market tightness, and government policies that lower interest rates or do not raise them sufficiently to counteract inflation. An economic slowdown or a recession could reduce the prices our customers are able or willing to pay for our products and services and reduce the volume of their purchases. In addition to rising inflation, rising interest rates, the impact of banking failures or perceived failures and related contagion, political tensions, military conflicts, and civil unrest may contribute to recessionary pressure. Changes in the economic environments in which we operate might have a materially adverse impact on our business operations and our financial position or results of operations.

We rely on sophisticated information systems and networks to perform our business operations, such as to obtain, rapidly process, analyze, and manage data that facilitate the purchase and distribution of thousands of inventory items from distribution centers. We provide remote services that involve hosting customer data and operating software on our own or third-party systems. Our customers rely on their ability to access and use these systems, and their data, as needed, and our ability to compete effectively is increasingly dependent on access to, and interpretation of, data. Data quality impacts customer ordering, order fulfillment and higher order processing. If we fail to effectively implement and maintain data governance structures across our businesses, to effectively interpret and utilize such data, or protect the integrity of such data, including systems 16 16 16 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We rely on sophisticated information systems and networks to perform our business operations, such as to obtain, rapidly process, analyze, and manage data that facilitate the purchase and distribution of thousands of inventory items from distribution centers. We provide remote services that involve hosting customer data and operating software on our own or third-party systems. Our customers rely on their ability to access and use these systems and their data as needed. The networks and hosting systems are vulnerable to interruption or damage from sources beyond our control, such as power loss, telecommunications failures, fire, natural disasters, including as a result of climate change, software and hardware failures, and cybersecurity incidents. If those information systems or networks suffer errors, interruptions, or become unavailable, or if the timely delivery of medical care or other customer business requirements are impaired by data access, network, or systems problems, we might experience injury to patients or consumers, litigation or regulatory action, disruption of our business operations, loss of customers or revenue, cash flow impacts, and increased expense. Any such problems might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

From time to time we are adversely affected by conditions and events outside of our control, including: widespread public health issues such as epidemic or pandemic infectious diseases; natural disasters and other catastrophic events such as earthquakes, floods, or severe weather; and geopolitical factors such as terrorism, military conflicts, civil unrest, political circumstances (including changes in international relations), changes or uncertainty in government policies (including with respect to U.S. or international trade), actual or announced tariffs or other trade restrictions, or changes in laws or their interpretation. These conditions and events can disrupt operations for us, our suppliers, our vendors, and our customers, as well as impair product manufacturing, supply, and transport availability and cost in unpredictable ways that depend on highly uncertain future developments. They might affect consumer confidence levels and spending or the availability of certain goods, commodities, raw materials, and other inputs. In response to these types of conditions and events, we might seek alternate sources for product supply, incur additional sourcing or distribution costs, suspend operations, implement extraordinary procedures, or suffer consequences that are unexpected and difficult to mitigate. For example, recently imposed or announced U.S. tariffs, as well as any retaliatory tariffs or other trade restrictions imposed by other countries, might require us to incur substantial additional sourcing costs, raise prices on certain products, or seek alternate supply sources. If we are unable to effectively manage or offset the impact of new tariffs or other trade restrictions, or find alternate sources of supply, we might be competitively disadvantaged or experience reduced profit margins or supply disruptions. Further, we might suffer harm to our customer relationships. Any of the foregoing risks might have a materially adverse impact on our business operations and our financial position or results of operations.

We might be adversely affected by events outside of our control, including: widespread public health issues, such as epidemic or pandemic infectious diseases; natural disasters such as earthquakes, floods, or severe weather, including as a result of climate change; political events such as terrorism, political tensions, military conflicts, civil unrest, and trade wars; and by other catastrophic events. These events can disrupt operations for us, our suppliers, our vendors, and our customers, as well as impair product manufacturing, supply, and transport availability and cost in unpredictable ways that depend on highly uncertain future developments. They might affect consumer confidence levels and spending or the availability of certain goods or commodities. In response to these types of events, we might suspend operations, implement extraordinary procedures, seek alternate sources for product supply, or suffer consequences that are unexpected and difficult to mitigate. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

Investors, regulators, employees, customers, and other stakeholders continue to focus on companies’ governance and sustainability (“G&S”) practices and policies, including those related to human capital management, climate change, environmental responsibility, and social impact. Given the varied and at times divergent views of different stakeholder groups, any action or inaction by us with respect to G&S matters may be perceived negatively by some stakeholders. Furthermore, the G&S regulatory landscape is evolving and uncertain. New or revised laws and policies, or changes in the interpretation of existing laws and policies, could increase our compliance costs and expose us to legal risks. From time to time, we make statements regarding our sustainability goals. Although we intend to meet these goals, we may be required to expend significant resources to do so, which could impose costs on us. In addition, we could be criticized for the scope or nature of these goals, or for any revisions to our goals. Moreover, we may determine that it is in the best interests of the Company and our stockholders to prioritize other business investments over the achievement of our sustainability goals based on various factors such as our business strategy, technological and regulatory developments, industry standards, and input or pressure from stakeholders. If our G&S practices or outcomes do not align with stakeholder expectations or evolving regulatory requirements, our reputation, stock price, ability to access capital markets, and employee recruitment and retention efforts might be negatively affected. We also could face litigation or government action. Any of the foregoing risks might have a materially adverse impact on our business, financial condition, and results of operations.

Companies across all industries are facing increasing scrutiny relating to their sustainability and governance practices and policies. The landscape related to such regulation, compliance, and reporting is constantly evolving, including expanding in scope and complexity. For example, the SEC and the State of California have adopted laws that we anticipate will require significantly increased disclosures related to climate change. There are also proposed regulations, including federal acquisition regulations, which may impose additional and more expansive requirements. We may experience significant costs associated with regulatory compliance for sustainability and governance matters, including fees, licenses, reporting, and the cost of capital improvements for our operating facilities to meet environmental regulatory requirements. Increased focus and activism related to these topics may hinder our access to capital or negatively impact our stock price, as investors may reconsider their capital investment based on their assessment of our sustainability and governance practices and policies. In particular, investor advocacy groups, institutional investors, stockholders, employees, customers, regulators, proxy advisory services, and other market participants have increasingly focused on governance and sustainability practices and policies of companies. If our governance and sustainability practices do not meet investor or other stakeholder expectations, standards, or evolving frameworks and regulatory requirements, our stock price, brand, sales, ability to access capital markets, reputation, and employee retention, among other things, may be negatively affected. In addition, from time to time we make statements regarding our sustainability goals and efforts. Although we intend to meet these goals, we may be required to expend significant resources to do so, which could increase our operational costs. In addition, we could be criticized for the scope or nature of these goals, or for any revisions to our goals. Moreover, we may determine that it is in the best interest of our Company and our stockholders to prioritize other business, social, governance, or sustainable investments over the achievement of our current goals based on economic, technological developments, regulatory and social factors, business strategy, or pressure from investors, activist groups, or other stakeholders. 24 24 24 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We rely on third parties for the supply of pharmaceutical and other products, and our operations are subject to our suppliers’ continued ability to supply the products that we require. From time to time, we experience difficulties and delays in 21 21 21 Table of ContentsItem 1A IndexMcKESSON CORPORATION Table of ContentsItem 1A Index Table of Contents Item 1A Index

We experience difficulties and delays in sourcing and selling products due to a variety of causes, from time to time, such as: difficulties in complying with the legal requirements for export or import of pharmaceuticals or components; suppliers’ failure to satisfy production demand; manufacturing or supply problems such as inadequate resources; new innovative therapies that are expensive, complex, and fast-growing; product rationalization; and real or perceived quality issues. For example, the FDA banned certain manufacturers from selling raw materials and drug ingredients or finished goods in the U.S. due to quality issues. Difficulties in product manufacturing or access to raw materials or finished goods could result in supplier production shutdowns, product shortages, and other supply disruptions. Supply interruptions are often due to a variety of causes over which we have no control, such as export controls or trade sanctions, labor disputes, unavailability of key manufacturing sites, inability to procure raw materials or finished goods, quality control concerns, ethical sourcing issues, supplier’s financial distress or bankruptcy, natural disasters, including as a result of climate change, civil unrest or acts of war, the impact of epidemics or pandemics, and other general supply constraints. In these situations there may be no alternative sources of supply. Our inventory might be requisitioned, diverted, or allocated by government order such as under emergency, disaster, and civil defense declarations. Changes in the healthcare industry’s or our suppliers’ pricing, selling, inventory, distribution, or supply policies or practices could significantly reduce our revenues and net income. Any of these changes or disruptions might have a materially adverse impact on our business operations and our financial position or results of operations.