Clorox 10-Q 2023-09-30

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

For the quarterly period ended September 30, 2023.

OR

For the transition period from to

Commission File Number: 1-07151

THE CLOROX COMPANY

(Exact name of registrant as specified in its charter)

1221 Broadway, Oakland, California, 94612-1888

(Address of principal executive offices) (Zip code)

(510) 271-7000

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☑

As of October 18, 2023, there were 124,059,098 shares outstanding of the registrant’s common stock ($1.00 par value).

TABLE OF CONTENTS

PART I – FINANCIAL INFORMATION

The Clorox Company

Condensed Consolidated Statements of Earnings and Comprehensive Income (Unaudited)

(Dollars in millions, except per share data)

See Notes to Condensed Consolidated Financial Statements (Unaudited)

The Clorox Company

Condensed Consolidated Balance Sheets

(Dollars in millions, except per share data)

Showing the first 8K of 80K characters. Open the full section

The Clorox Company (Dollars in millions, except per share data)

Management’s Discussion and Analysis of Financial Condition and Results of Operations (MD&A) is designed to provide a reader of The Clorox Company’s (the Company or Clorox) financial statements with a narrative from the perspective of management on the Company’s financial condition, results of operations, liquidity and certain other factors that may affect future results. The following discussion of the Company’s financial condition and results of operations should be read in conjunction with MD&A and the consolidated financial statements and related notes included in the Company’s Annual Report on Form 10-K for the fiscal year ended June 30, 2023, which was filed with the SEC on August 10, 2023, and the unaudited condensed consolidated financial statements and related notes contained in this Quarterly Report on Form 10-Q (this Report). Unless otherwise noted, MD&A compares the three month period ended September 30, 2023 (the current period) to the three month period ended September 30, 2022 (the prior period), with percentage and basis point calculations based on rounded numbers, except for per share data and the effective tax rate.

EXECUTIVE OVERVIEW

The Clorox Company is a leading multinational manufacturer and marketer of consumer and professional products with approximately 8,700 employees worldwide. The Company has operations in approximately 25 countries or territories and sells its products in more than 100 markets, primarily through mass retailers; grocery outlets; warehouse clubs; dollar stores; home hardware centers; drug, pet and military stores; third-party and owned e-commerce channels; and distributors. Clorox markets some of the most trusted and recognized consumer brand names, including its namesake bleach, cleaning and disinfecting products, Pine-Sol® and Tilex® cleaners; Liquid-Plumr® clog removers; Poett® home care products; Glad® bags and wraps; Fresh Step® cat litter; Kingsford® grilling products; Hidden Valley® dressings, dips, seasonings and sauces; Burt’s Bees® natural personal care products; Brita® water-filtration products; and Natural Vitality®, RenewLife®, NeoCell® and Rainbow Light® vitamins, minerals and supplements. The Company also markets industry-leading products and technologies for professional customers, including those sold under the CloroxPro™ and Clorox Healthcare® brand names.

The Company primarily markets its leading brands in midsized categories considered to be financially attractive. Most of the Company’s products, which can be found in about nine of 10 U.S. homes, compete with other nationally advertised brands within each category and with “private label” brands. About 80% of the Company’s sales are generated from brands that hold the No. 1 or No. 2 market share position in their categories.

The Company operates through strategic business units (SBUs) which are organized into operating segments. Operating segments are then aggregated into four reportable segments: Health and Wellness, Household, Lifestyle and International. Operating segments not aggregated into a reportable segment are reflected in Corporate and Other. The four reportable segments consist of the following:

• Health and Wellness consists of cleaning, disinfecting and professional products mainly marketed and sold in the United States. Products within this segment include home care cleaning products and laundry additives primarily under the Clorox®, Clorox2®, Pine-Sol, Scentiva®, Tilex, Liquid-Plumr, and Formula 409® brands; professional cleaning and disinfecting products under the CloroxPro and Clorox Healthcare brands; and professional food service products under the Hidden Valley brand.

• Household consists of bags and wraps, cat litter and grilling products marketed and sold in the United States. Products within this segment include bags and wraps under the Glad brand; cat litter primarily under the Fresh Step and Scoop Away® brands; and grilling products under the Kingsford brand.

• Lifestyle consists of food, natural personal care products and water-filtration products marketed and sold in the United States. Products within this segment include dressings, dips, seasonings and sauces, primarily under the Hidden Valley brand; natural personal care products under the Burt’s Bees brand; and water-filtration products under the Brita brand.

• International consists of products sold outside the United States. Products within this segment include laundry additives; home care products; water-filtration products; digestive health products; grilling products; cat litter; food; bags and wraps; natural personal care products; and professional cleaning and disinfecting products marketed primarily under the Clorox, Ayudin®, Clorinda®, Poett, Pine-Sol, Glad, Brita, RenewLife, Ever Clean® and Burt’s Bees brands.

RECENT EVENTS AFFECTING THE COMPANY

Cyberattack

On Monday, August 14, 2023, the Company disclosed it had identified unauthorized activity on some of its Information Technology (IT) systems. That activity began on Friday, August 11, 2023 and after becoming aware of it that evening, the Company immediately began taking steps to stop and remediate the activity. The Company also took certain systems offline and engaged third-party cybersecurity experts to support its investigation and recovery efforts. The Company implemented its business continuity plans, including manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers. However, the incident resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the quarter.

The impacts of these system disruptions included order processing delays and significant product outages, resulting in a negative impact on net sales and earnings. The Company has since transitioned back to automated order processing and the vast majority of orders are taking place in an automated manner. The Company expects to experience ongoing, but lessening, operational impacts in the second quarter as it makes progress in returning to normalized operations.

The effects of the cyberattack are expected to negatively impact fiscal year 2024 results, though some of the anticipated net sales not recognized in the first quarter as a result of the disruptions are expected to be recognized in subsequent quarters of fiscal year 2024 as customers rebuild inventories.

The Company also incurred incremental expenses of approximately $24 as a result of the cyberattack for the three months ended September 30, 2023. These costs relate to third-party consulting services, including IT recovery and forensic experts and other professional services incurred to investigate and remediate the attack, as well as incremental operating costs incurred from the resulting disruption to the Company’s business operations. The Company expects to incur additional costs related to the cyberattack in future periods.

The Company has not recognized any insurance proceeds in the three months ended September 30, 2023 related to the cyberattack. The timing of recognizing insurance recoveries, if any, may differ from the timing of recognizing the associated expenses.

Other Recent Events

For the fiscal quarter ended September 30, 2023, the Company continued to experience an inflationary environment marked by persistently unfavorable commodity costs and higher manufacturing and logistics costs. Additionally, the Company is monitoring macroeconomic conditions as a result of increased interest rates and volatility in capital markets. These evolving challenges contributed to a highly dynamic operating environment as the Company continued its efforts to drive growth, rebuild margins and drive its transformation.

The risks of future negative impacts due to transportation, logistical or supply constraints and higher commodity costs for certain raw materials remain prese

Showing the first 8K of 61K characters. Open the full section

There have not been any material changes to the Company’s market risk since June 30, 2023. For additional information, refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included in Exhibit 99.1 of the Company’s Annual Report on Form 10-K for the fiscal year ended June 30, 2023.

The Company’s management, with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of the Company’s disclosure controls and procedures as of the end of the period covered by this Report. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures, as of the end of the period covered by this Report, were effective such that the information required to be disclosed by the Company in reports filed under the Exchange Act is (i) recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and (ii) accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

On Monday, August 14, 2023, the Company disclosed it had identified unauthorized activity on some of its Information Technology (IT) systems; see Note 2 in the condensed consolidated financial statements in this Report. That activity began on Friday, August 11, 2023 and after becoming aware of it that evening, the Company immediately began taking steps to stop and remediate the activity. The Company also took certain systems offline and engaged third-party cybersecurity experts to support its investigation and recovery efforts. The Company implemented its business continuity plans, including manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers. However, the incident resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the quarter.

During the disruptions caused by the cyberattack, we deployed additional interim controls in response to taking certain systems offline during the period to maintain our internal control over financial reporting.

Other than the additional interim controls and procedures implemented in connection with the execution of the Company’s existing business continuity plans as a result of the cyberattack discussed above, no change in the Company’s internal control over financial reporting occurred during the first fiscal quarter of the fiscal year ending June 30, 2024, that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

PART II – OTHER INFORMATION

Item 1.A. Risk Factors

For information regarding Risk Factors, please refer to Item 1.A. in the Company’s Annual Report on Form 10-K for the fiscal year ended June 30, 2023, as supplemented by the following revised risk factor, and the information in “Cautionary Statement” included in this Report.

Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on the Company’s business, financial condition, results of operations and reputation.

To conduct its business, the Company relies extensively on information and operational technology systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, vendors, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements. Furthermore, the Company sells certain of its natural personal care products, vitamins, minerals, supplements and other products directly to consumers online and through websites, mobile apps and connected devices, and the Company also engages in online activities, including promotions, rebates and customer loyalty and other programs, through which it may receive personal information. Through the use of any of these information and operational technology systems or processes, the Company or its vendors have in the past and could in the future again experience cyberattacks, privacy breaches, data breaches or other incidents that may result in unauthorized access, disclosure and misuse of consumer, customer, employee, vendor or Company information, especially as the Company continues operating under a hybrid working model under which employees can work and access the Company’s technology infrastructure remotely. A breach or other breakdown in the Company’s technology, including a cyberattack, privacy breach, data breach or other incident involving the Company or any of the Company's third-party service providers or vendors could adversely affect the Company’s financial condition and results of operations.

On August 14, 2023, the Company disclosed that it had identified unauthorized activity on some of its IT systems and took immediate steps to stop and remediate the activity, including taking certain systems offline. The Company implemented its business continuity plans, including manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers, which resulted in an elevated level of consumer product availability issues.

Based on the information currently available, the Company believes the cyberattack is contained due to the steps the Company has taken to address the incident. However, due to the order processing delays and elevated level of product outages, the incident has negatively impacted the Company's fiscal first quarter financial results, and is expected to negatively impact its fiscal 2024 financial results. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations”. Based on its current assessment of the situation, the Company expects to experience ongoing, but lessening, operational impacts in the fiscal second quarter as it makes progress in returning to normalized operations. The cyberattack may also lead to additional regulatory scrutiny or litigation exposure.

The cyberattack also damaged portions of the Company’s IT infrastructure, which caused wide-scale disruption of the Company’s operations. The Company is repairing its infrastructure and is reintegrating the systems that it took offline. For more information regarding this incident, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and “Note 2. Cyberattack”.

In addition to repairing its infrastructure as a result of the cyberattack, the Company is in the process of a multi-year phased upgrade of its digital capabilities, including enhancing operating efficiencies and transitioning to a cloud-based platform, as well as replacing its enterprise resource planning system. It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of further security breaches, system failures and disruptions. Any such upgrade could take time, oversight and be costly to the Company, and may include potential challenges, such as the cost of training personnel, migration of data, the potential instability of the new system and cost overruns. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows.

Despite the security measures the Company has in place, the information and operational technology systems, including those of our customers, vendors, suppliers and other third-party service providers with whom we have contracted, have, in the past,

ITEM 1.A. RISK FACTORS (Continued)

and may, in the future, be vulnerable to cyber-threats such as computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks and other disruptions from employee error, unauthorized uses, system failures, including Internet outages, unintentional or malicious actions of employees or contractors or cyberattacks by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. The Company’s information and operational technology systems and its third-party providers’ systems, have been, and will continue to be, subject to cyber-threats such as computer viruses or other malicious codes, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, social engineering, hacking and other cyberattacks attempting to exploit vulnerabilities. The Company has seen and may continue to see an increase in the number of such attacks, especially as the Company continues operating under a hybrid working model under which employees can work and access the Company’s technology infrastructure remotely. In addition, while we have purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of our cybersecurity insurance policy. As cyberattacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as appropriate for our operations.

The Company’s security efforts and the efforts of its third-party providers may not prevent or timely detect future attacks and resulting breaches or breakdowns of the Company’s, or its third-party service providers’, databases or systems. In addition, if the Company or its third-party providers are unable to effectively resolve such breaches or breakdowns on a timely basis, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, and litigation and remediation expenses. In addition, such incidents could result in unauthorized disclosure and misuse of material confidential information, including personal identifying information.

Cyber-threats are becoming more sophisticated, are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. We have incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm our business.

In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, vendor or employee information or related data. These laws and regulations change frequently, and new legislation continues to be introduced and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and they subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data.

These risks also may be present to the extent any of our partners, distributors, joint venture partners or suppliers using separate information or operational technology systems, not integrated with the systems of the Company, suffers a cyberattack and could result in increased costs related to our involvement in investigations or notifications conducted by these third parties. These risks may also be present to the extent a business we have acquired, that does not use our information or operational technology systems, experiences a system shutdown, service disruption, or cyberattack.

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds

In May 2018, the Board of Directors authorized the Company to repurchase up to $2,000 million in shares of common stock on the open market (the 2018 Open-Market Program), which has no expiration date.

In August 1999, the Board of Directors authorized a stock repurchase program to reduce or eliminate dilution upon the issuance of common stock pursuant to the Company’s stock compensation plans (the Evergreen Program). In November 2005, the Board of Directors authorized the extension of the Evergreen Program to reduce or eliminate dilution in connection with issuances of common stock pursuant to the Company’s 2005 Stock Incentive Plan. The Evergreen Program has no expiration date and has no specified limit as to dollar amount and therefore is not included in column [d] below.

The following table sets forth the purchases of the Company’s securities by the Company and any affiliated purchasers within the meaning of Rule 10b-18(a)(3) (17 CFR 240.10b-18(a)(3)) during the first quarter of fiscal year 2024.

(1)Average price paid per share in the period includes commission.

During the three months ended September 30, 2023, none of our directors or officers (as defined in Rule 16a-1(f) under the Exchange Act) adopted or terminated any contract, instruction or written plan for the purchase or sale of our securities that was intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) under the Exchange act or any “non-Rule 10b5-1 trading arrangement,” as defined in Item 408(c) of Regulation S-K.

See Exhibit Index below, which is incorporated by reference herein.

EXHIBIT INDEX

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.