Item 1A. Risk Factors

The Company’s business, results of operations, and financial condition are subject to various risks and uncertainties, including those described in Part I, Item 1A: Risk Factors in the Company’s 2020 Form 10-K. The following risk factors are being provided to supplement and update the risk factors set forth in the 2020 Form 10-K.

Grainger’s business and operations have been and may continue to be adversely affected by the global outbreak of the Coronavirus (COVID-19 pandemic) and may be adversely affected by other global outbreaks of pandemic disease.

Any global outbreaks of pandemic disease, such as the COVID-19 pandemic, could have a material adverse effect on Grainger’s business, results of operations and financial condition, including liquidity, capital and financing resources.

The COVID-19 pandemic has disrupted and adversely affected Grainger’s business, including its business with customers and suppliers. Grainger has experienced customer disruptions to their ability or willingness to purchase Grainger products, customer delays in making purchasing decisions, shifts in the types and quantities of products purchased and, in some cases, diminished customer loyalty and retention rates. These may continue to persist during and beyond the COVID-19 pandemic. Grainger has also experienced and may continue to experience supply chain disruptions, supplier inability to manufacture or deliver products to Grainger or meet the unprecedented demand for pandemic-related products, rapid shifts in the type, quantity or quality of products sold, and higher product costs including as a result of inflation.

Additional effects from the COVID-19 pandemic on Grainger's business include adverse impacts on transportation, including shipping delays and port disruptions, the availability of products, and labor shortages, which have impacted Grainger’s ability to hire employees to fill all open positions. There is the potential for disruptions or closures of customer and supplier facilities, and the ability of certain customers and suppliers to continue as a going concern. Furthermore, Grainger's ability to collect its accounts receivable or receive product ordered from suppliers, as customers and suppliers face higher liquidity and solvency risks and seek terms that are less favorable to Grainger, may adversely affect the Company’s business. These developments, alone or in combination, could materially adversely affect Grainger’s future sales and results of operations.

The effects of the COVID-19 pandemic on Grainger also include restrictions on Grainger’s employees’ ability to visit customers and many of Grainger’s employees’ ability to work in offices or at facilities, as well as disruptions or temporary closures of the Company’s facilities, including distribution centers, branches, and support buildings. Some actions that Grainger has taken in response to the COVID-19 pandemic, including enabling remote working arrangements, may create increased vulnerability to cybersecurity incidents, including breaches of information systems security, which could damage Grainger’s reputation and commercial relationships, disrupt operations, increase costs and/or decrease revenues, and expose Grainger to claims from customers, suppliers, financial institutions, regulators, payment card association, employees and others. In addition, Grainger’s remote working arrangements have required the Company to make adaptions to its controls and procedures, including to its financial reporting processes, that could impact the design or operating effectiveness of such controls or procedures. The COVID-19 pandemic has also resulted in increased variable compensation, wage rates and employee healthcare costs, and Grainger expects these trends to continue.

Furthermore, as result of surges in demand and disruptions in supply chains, including in Asia and other locations, the COVID-19 pandemic has resulted in shortages of certain PPE, cleaning supplies and other products, which may materially impact Grainger's ability to obtain or deliver inventory to customers on a timely basis or at all. While Grainger attempts to maintain sufficient inventory levels to meet quickly shifting customer demand patterns and supplier lead time requirements, which may become extended due to the pandemic demand increase, the Company cannot be certain it will be able to accurately predict demand or lead times, which might cause it to be unable to service customer demand or expose it to risks of product shortages. This uncertainty has caused and may continue to cause Grainger to acquire excess inventory, which has led and may lead to additional inventory carrying costs and inventory obsolescence. For example, as discussed in the Company’s Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2021 and June 30, 2021, respectively, the Company had certain pandemic-related

inventory adjustments in the U.S. business (part of High-Touch Solutions N.A.) on certain non-core SKUs, which were selling below cost based on then current market-relevant pricing.

Pandemic product shortages may also require the Company to attempt to procure products from new suppliers or through brokers with whom it has a limited or no prior relationship. Despite due diligence and product compliance protocols, the products from these sources may not be delivered on a timely basis or at all, or their quality may not be as represented, all of which could cause Grainger to incur costs, including the expense of procuring alternate products or recalling or replacing products in addition to other adverse impacts to Grainger’s business.

Moreover, global outbreaks such as the COVID-19 pandemic have resulted in a widespread health crisis that has adversely affected and could continue to adversely affect the economies of many countries, resulting in a global or regional economic downturn or recession. Any such recession could result in a significant decline in demand for the Company’s products or limit Grainger’s ability to access capital markets on terms that are attractive or at all, any of which could materially adversely affect the Company’s business, results of operations and financial condition.

The duration and ultimate impact of the COVID-19 pandemic on the Company’s business, results of operations and financial condition, including liquidity, capital and financing resources, will depend on numerous evolving factors and future developments, which are highly uncertain and cannot be predicted at this time. Such factors and developments may include the geographic spread, severity and duration of the COVID-19 pandemic, including whether there are periods of increased COVID-19 cases, the further spread of the Delta variant or the emergence of other new or more contagious variants that may render vaccines ineffective or less effective, disruption to Grainger’s operations resulting from employee illnesses or any inability to attract, retain or motivate employees, the development, availability and administration of effective treatment or vaccines and the willingness of individuals to receive a vaccine or otherwise comply with various mandates, the extent and duration of the impact on the U.S. or global economy, including the pace and extent of recovery when the pandemic subsides, and the actions that have been or may be taken by various governmental authorities in response to the outbreak.

The Company is a federal contractor and part of its workforce will be covered by vaccine mandates expected to be imposed by Executive Order, while other members of its workforce are likely to be covered by anticipated Occupational Health and Safety Administration safety directives for vaccination or testing. Complying with these requirements could disrupt the workforce and operations and impose additional compliance and other costs. Other requirements, including health and safety measures, such as mandatory facility closures of non-essential businesses, stay in shelter health orders or similar restrictions, social distancing mandates and/or travel bans, import and export restrictions, pricing mandates, including disaster or emergency declaration pricing statutes, and mandatory directives that certain products be allocated or provided to certain customers, could also disrupt the Company’s business and impose costs. If the Company is unable to respond to and manage the impact of these mandates, requirement or events, the Company’s business and results of operations may continue to be adversely affected.

Cybersecurity incidents, including breaches of information systems security, could damage Grainger’s reputation, disrupt operations, increase costs and/or decrease revenues.

Through Grainger’s sales and eCommerce channels, Grainger collects and stores personally identifiable, confidential, proprietary and other information from customers so that they may, among other things, purchase products or services, enroll in promotional programs, register on Grainger’s websites or otherwise communicate or interact with the Company. Moreover, Grainger’s operations routinely involve receiving, storing, processing and transmitting sensitive information pertaining to its business, customers, suppliers and employees, and other sensitive matters.

Cyber threats are rapidly evolving and those threats and the means for obtaining access to information in digital and other storage media are becoming increasingly sophisticated. Each year, cyber-attackers make numerous attempts to access the information stored in the Company’s information systems. If successful, these attacks may expose Grainger to risk of loss or misuse of proprietary or confidential information or disruptions of business operations.

Grainger's IT infrastructure also includes products and services provided by suppliers, vendors and other third parties, and these providers can experience breaches of their systems and products that impact the security of systems and proprietary or confidential information. Moreover, from time to time, Grainger may share information with these third parties in connection with the products and services they provide to the business. While Grainger requires assurances that these third parties will protect confidential information, there is a risk that the confidentiality of data held or accessed by them may be compromised. If successful, those attempting to penetrate Grainger’s or its vendors’ information systems may misappropriate intellectual property or personally identifiable, credit card,

confidential, proprietary or other sensitive customer, supplier, employee or business information, or cause systems disruption. While many of Grainger's agreements with these third parties include indemnification provisions, the Company may not be able to recover sufficiently, or at all, under such provisions to adequately offset any losses it may incur.

Moreover, the Company may face the threat to its computer systems of unauthorized access, computer hackers, computer viruses, malicious code, ransomware, phishing, organized cyber-attacks and other security problems and system disruptions. Such tactics may also seek to cause payments due to or from the Company to be misdirected to fraudulent accounts, which may not be recoverable by the Company.

In addition, a Grainger employee, contractor or other third party with whom Grainger does business may attempt to circumvent security measures or otherwise access Grainger’s information systems in order to obtain such information or inadvertently cause a breach involving such information. Further, Grainger’s systems are integrated with customer systems in certain cases, and a breach of the Company’s information systems could be used to gain illicit access to a customer’s systems and information.

Grainger has been subject to unauthorized accesses of certain supplier and customer information in the past, which it deemed immaterial to its business and operations, and may be subject to other unauthorized accesses of its systems in the future. There can be no assurance that any future unauthorized access to or breach of Grainger’s information systems will not be material to Grainger’s business, operations or financial condition.

Grainger maintains information security staff, policies and procedures for managing risk to its information security systems, conducts annual employee awareness training of cybersecurity threats and routinely utilizes consultants to assist in evaluating the effectiveness of the security of its IT systems. While Grainger has instituted these and other safeguards for the protection of information, because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until they are launched against a target, Grainger may be unable to anticipate these techniques or implement adequate preventative measures. Any breach of Grainger’s security measures or any breach, error or malfeasance of those of its third party service providers could cause Grainger to incur significant costs to protect any customers, suppliers, employees, and other parties whose personal data is compromised and to make changes to its information systems and administrative processes to address security issues. In addition, although Grainger maintains insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses.

Grainger continuously evaluates the need to upgrade and/or replace its systems and network infrastructure to protect its computing environment, to stay current on vendor supported products and to improve the efficiency of its systems and for other business reasons. The implementation of new systems and IT could adversely impact its operations by imposing substantial capital expenditures, demands on management time and risks of delays or difficulties in transitioning to new systems. In addition, the Company's systems implementations may not result in productivity improvements at the levels anticipated. Systems implementation disruption and any other IT disruption, if not anticipated and appropriately mitigated, could have an adverse effect on its business.

Loss of customer, supplier, employee or intellectual property or other business information or failure to comply with data privacy and security laws could disrupt operations, damage Grainger’s reputation and expose Grainger to claims from customers, suppliers, financial institutions, regulators, payment card associations, employees and others, any of which could have a material adverse effect on Grainger, its financial condition and results of operations. In the past, Grainger has experienced certain cybersecurity incidents. In each instance, Grainger provided notifications and adopted remedial measures. While these incidents have not been deemed to be material to Grainger, there can be no assurance that a future breach or incident would not be material to Grainger’s operations and financial condition.

Item 2: Unregistered Sales of Equity Securities and Use of Proceeds

Issuer Purchases of Equity Securities – Third Quarter

(A)There were no shares withheld to satisfy tax withholding obligations.

(B)Average price paid per share excludes commissions of $0.01 per share paid.

(C)Purchases were made pursuant to a share repurchase program approved by Grainger's Board of Directors and announced April 28, 2021 (2021 Program). The 2021 Program authorized the repurchase of up to 5 million shares with no expiration date.

(D)The difference of 680 shares between the Total Number of Shares Purchased and the Total Number of

Shares Purchased as Part of Publicly Announced Plans or Programs represents shares purchased by the

administrator and record keeper of the W.W. Grainger, Inc. Retirement Savings Plan for the benefit

of the employees who participate in the plan.