Veeva Systems 10-K 2024-01-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended January 31, 2024

OR

For the transition period from to .

Commission File Number: 001-36121

Veeva Systems Inc.

(Exact name of registrant as specified in its charter)

4280 Hacienda Drive

Pleasanton, California, 94588

(Address of principal executive offices)

(Registrant’s telephone number, including area code) (925) 452-6500

(Former name, former address and former fiscal year, if changed since last report) N/A

Securities registered pursuant to Section 12(b) of the Act:

Indicate by a check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☒ No ☐

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of voting stock held by non-affiliates of the Registrant on the last business day of the Registrant’s most recently completed second fiscal quarter, which was July 31, 2023, based on the closing price of $204.22 for shares of the Registrant’s Class A common stock as reported by the New York Stock Exchange on July 31, 2023, the last trading day of the second fiscal quarter, was approximately $29.7 billion. Shares of Class A common stock held by each executive officer, director, and their affiliated holders have been excluded in that such persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

As of February 29, 2024, there were 161,316,597 shares of the Registrant’s Class A common stock outstanding. We refer to our Class A common stock as our “common stock.”

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Registrant’s Proxy Statement for the 2024 Annual Meeting of Stockholders are incorporated herein by reference in Part III of this Form 10-K to the extent stated herein. The proxy statement will be filed by the Registrant with the Securities and Exchange Commission within 120 days after the end of the Registrant’s fiscal year ended January 31, 2024.

TABLE OF CONTENTS

Pursuant to Part IV, Item 16, a summary of Form 10-K content follows, including hyperlinked cross-references (in the EDGAR filing). This allows users to easily locate the corresponding items in this annual report on Form 10-K where the disclosure is fully presented. The summary does not include certain Part III information that will be incorporated by reference from the Proxy Statement for the 2024 Annual Meeting of Stockholders, which will be filed within 120 days after our fiscal year ended January 31, 2024.

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This report on Form 10-K contains forward-looking statements that are based on our beliefs and assumptions and on information currently available to us. Forward-looking statements include information concerning our possible or assumed future results of operations and expenses, business strategies and plans, trends, market sizing, competitive position, industry environment, potential growth opportunities, and product capabilities among other things. Forward-looking statements include all statements that are not historical facts and, in some cases, can be identified by terms such as “aim,” “anticipates,” “believes,” “could,” “estimates,” “expects,” “goal,” “intends,” “may,” “plans,” “potential,” “predicts,” “projects,” “seeks,” “should,” “strive,” “will,” “would,” or similar expressions and the negatives of those terms.

Forward-looking statements are based on our current views and expectations and involve known and unknown risks, uncertainties and other factors—including those described in “Risk Factors,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and elsewhere in this report—that may cause our actual results, performance or achievements to be materially different from any future results, performance, or achievements expressed or implied by the forward-looking statements. Given these uncertainties, you should not place undue reliance on these forward-looking statements.

Any forward-looking statements in this report are made only as of the date of this report. Except as required by law, we disclaim any obligation to update these forward-looking statements publicly, or to update the reasons actual results could differ materially from those anticipated in these forward-looking statements, even if new information becomes available in the future.

As used in this report, the terms “Veeva,” “Registrant,” “the Company,” “we,” “us,” and “our” mean Veeva Systems Inc. and its subsidiaries unless the context indicates otherwise.

PART I.

Overview

Veeva is the leading provider of industry cloud solutions for the global life sciences industry. Our offerings span cloud software, data, and business consulting and are designed to meet the unique needs of our customers and their most strategic business functions—from research and development (R&D) through commercialization. Our solutions help life sciences companies develop and bring products to market faster and more efficiently, market and sell more effectively, and maintain compliance with government regulations.

Customer success is one of our core values, and our focus on it has allowed us to deepen and expand our strategic relationships with customers over time. Because of our industry focus, we have a unique, in-depth perspective into the needs and best practices of life sciences companies and clinical research sites. This allows us to develop targeted solutions, quickly adapt to regulatory changes, and incorporate highly relevant enhancements into our existing solutions at a rapid pace.

Our goal is to become the most strategic technology partner to the life sciences industry and achieve long-term leadership with our solutions that support the R&D and commercial functions of life sciences companies. Our commercial solutions help life sciences companies achieve better, more intelligent engagement with healthcare professionals and healthcare organizations across multiple communication channels, and plan and execute more effective media and marketing campaigns. Our R&D solutions for the clinical, regulatory, quality, and safety functions help life sciences companies streamline their end-to-end product development processes to increase operational efficiency and maintain regulatory compliance throughout the product life cycle. Our solutions for clinical research sites enable regulatory documents and trial information to be managed in a modern cloud solution that is intended to accelerate the clinical research process for the life sciences industry overall.

We also bring the benefits of our content and data management solutions to customers in the consumer products industries. Our applications currently offered to companies in these industries are designed to help customers efficiently manage critical processes and content in a compliant way, and to enable secure collaboration across internal and external stakeholders, including outsourcing partners and vendors.

On February 1, 2021, after approval by our stockholders, we became a Delaware public benefit corporation (PBC). A PBC is a for-profit company operating under subchapter XV of the General Corporation Law of the State of Delaware (i) that has adopted a public benefit purpose intended to provide benefits beyond just stockholder financial returns, and (ii) whose directors have a fiduciary duty to balance the financial interests of stockholders, the best interests of other stakeholders materially affected by the company's conduct (which we believe includes customers, employees, partners, and the communities in which we operate), and the pursuit of the company's public benefit purpose. Our public benefit purpose, as reflected in our certificate of incorporation, is “to provide products and services that are intended to help make the industries we serve more productive, and to create high-quality employment opportunities in the communities in which we operate.” We believe that operating as a PBC reflects our core values—do the right thing, customer success, employee success, and speed—and helps us maintain alignment with the principal industry we serve, life sciences, and its broad goal to improve health and extend lives.

Our Industry Cloud Solutions for Life Sciences

Our industry cloud solutions for the life sciences industry are grouped into three major product categories—Veeva Development Cloud, Veeva Commercial Cloud, and Veeva Data Cloud—and are designed to address pharmaceutical, biotechnology, and medical devices and diagnostics (MedTech) companies’ most pressing strategic needs in their commercial and R&D operations. For financial reporting purposes, revenues associated with our Veeva Commercial Cloud, Veeva Data Cloud, and Veeva Claims solutions are classified as “Commercial Solutions” revenues, and revenues associated with our Veeva Development Cloud, Veeva RegulatoryOne, and Veeva QualityOne solutions are classified as “R&D Solutions” revenues.

Veeva Development Cloud includes application suites for the clinical, regulatory, quality, and safety functions of life sciences companies, all built on our proprietary Veeva Vault platform. Veeva Vault’s unique ability to handle content and data allows us to build content and data-centric applications to help customers streamline end-to-end business processes and eliminate manual processes and siloed systems. Veeva Vault can be deployed one application at a time or as an integrated solution with multiple applications that enable customers to unify and manage important documents and related data in a single global system.

• Veeva Vault Clinical** advances clinical trial execution by providing a complete and connected technology ecosystem. Our clinical platform is designed to enable seamless execution and flow of data between clinical trial stakeholders—including patients, research sites, contract research organizations (CROs), and trial sponsors—for faster, more efficient trials that achieve higher data accuracy and increased patient diversity. The platform is comprised of our clinical suite and applications for clinical research sites and patient engagement.

• Veeva** Clinical Data Management Suite (CDMS) helps sponsors and CROs design and run trials with tools to speed the build process and eliminate manual steps. This includes solutions for electronic data capture; aggregating, cleaning, and transforming clinical data; and randomization and trial supply management. Veeva Clinical Operations Suite offers applications such as Veeva Vault eTMF, an electronic trial master file application, Veeva Vault CTMS for clinical trial management, and solutions for automating the flow of clinical trial information between sponsors, CROs, and clinical research sites and for better collaboration and faster clinical trials.

• Our suite of applications for clinical research sites and patient engagement makes clinical trial participation easier for patients and streamlines study execution for research sites and trial sponsors. These offerings include applications that allow sites to maintain and access study documents electronically, to securely exchange information with sponsors and CROs, and to enable electronic processing of consents and assessments of clinical trial participants.

• Veeva Vault Quality** is the life science industry’s only unified suite of applications for managing quality content, processes, and training on a single cloud platform. Applications include solutions for aggregating and managing quality content, harmonizing quality processes, and simplifying employee qualification. The unification of quality processes and systems increases operational efficiency, enables continuous improvement, and drives compliance.

• Veeva Vault Safety is a suite of applications that unifies systems and processes to enable proactive patient safety. These offerings include applications that manage drug safety content as well as the intake, processing, and submission of adverse event data.

• Veeva Vault RIM is a suite of applications that provides fully integrated regulatory information management capabilities on a single cloud platform. These offerings include applications that enable life sciences companies to manage, track, and report product and registration information and to facilitate content planning, authoring, publishing, and archiving of regulatory submissions to healthcare authorities.

Veeva Commercial Cloud is a product category comprised of software and analytics solutions built specifically for life sciences companies to more efficiently and effectively commercialize their products. Veeva Commercial Cloud includes solutions for the sales, marketing, and medical affairs functions of a life sciences company:

• Veeva CRM** suite enables customer-facing employees at pharmaceutical and biotechnology companies—including sales representatives and medical science liaisons—to manage, track, and optimize engagement with healthcare professionals with a single, integrated solution. In addition, we offer multichannel CRM applications that can enhance and extend our core CRM and Medical CRM products, providing customers with an end-to-end solution across all key channels, including face-to-face, email, and virtual engagement, live and virtual enterprise events, and field collaboration. All support the life sciences industry’s unique commercial business processes and regulatory compliance requirements with highly specialized functionality. Veeva CRM and some of its applications are built on a platform provided by Salesforce, Inc. and will be supported until September 1, 2030. Veeva Vault CRM is our next generation CRM solution that is built on our proprietary Veeva Vault platform and will include the full functionality of Veeva CRM. Vault CRM is currently used by early adopters and planned for general availability in April 2024.

• Veeva Vault Medical** provides a single, validated source of medical content across multiple channels and geographies with capabilities for medical affairs teams to centralize medical inquiries and content.

• Veeva Vault PromoMats is an end-to-end content and digital asset management (DAM) solution through which life sciences companies can collaborate, review, distribute, and update commercial content and manage assets.

• Veeva Crossix** provides pharmaceutical brands a best-in-class analytics platform to maximize media investments and drive greater marketing effectiveness.

Veeva Data Cloud is a modern data platform comprised of connected reference data, deep data, and transaction data. The platform is designed to bring greater efficiency and precision across clinical and commercial operations of a life sciences company:

• Veeva OpenData is customer reference data. This includes demographic information, license information and status, specialty information, affiliations, and other key data about healthcare providers (HCP) and organizations that is crucial to customer engagement and compliance.

• Veeva Link** applications are built on a modern data platform that combines intelligent software automation with human curation to provide deep data across a growing number of areas, including key people, publications, conferences, and digital engagement.

• Veeva Compass** is a suite of de-identified U.S. longitudinal patient, projected prescriber, and national data designed for a wide range of commercial use cases, including business planning, patient finding, patient journey analytics, segmentation and targeting, forecasting, and incentive compensation.

Our Cloud Solutions for the Consumer Products Industries

Our initial applications for customers outside of life sciences address specific content and data management processes within the consumer products industries. Veeva QualityOne is a robust quality management, document management, and training solution. Veeva RegulatoryOne helps companies manage regulatory submission content. Veeva Claims addresses the end-to-end product and marketing claims management process.

Professional Services and Support

We offer professional services to help customers maximize the value of our solutions. Our service teams possess industry expertise, project management capabilities, and deep technical acumen that we believe our customers highly value. Our professional services teams work with our systems integrator partners to deliver projects. We offer the following professional services:

• implementation and deployment planning and project management;

• requirements analysis, solution design and configuration;

• systems environment management and deployment services;

• services focused on advancing or transforming business and operating processes related to Veeva solutions;

• technical consulting services related to data migration and systems integrations;

• training on our solutions; and

• ongoing managed services, such as outsourced systems administration.

We organize our professional services teams by specific expertise so that they can provide advice and support for best industry practices in the research and development and commercial departments of our customers.

Our global systems integrator partners also deliver implementation and selected support services to customers who wish to utilize them. Our systems integrator partners include Accenture, Cognizant, Tata Consultancy Services (TCS), and other life sciences specialty firms.

Veeva Business Consulting

We offer Veeva Business Consulting services through dedicated teams that are distinct from our professional services and support organization. Veeva Business Consulting provides strategic consulting services and solutions that are often enabled by our unique industry-wide perspective and proprietary data. Commercial Business Consulting typically focuses on a particular customer success initiative, commercial strategy, or business process change like digital engagement, commercial content management, field optimization, and commercial insights and analytics. R&D Business Consulting enables continuous and sustainable innovation across the drug development

value chain, including process efficiency, time-to-market acceleration, and optimized operating model and governance.

Our Customers

As of January 31, 2024, we served 1,432 customers. For an explanation of how we define current customers, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Components of Results of Operations.” We deliver solutions to companies throughout the life sciences industry, including pharmaceutical, biotechnology, and medical device companies, contract sales organizations, and contract research organizations. Our life sciences customers range from the largest global pharmaceutical and biotechnology companies such as Bayer AG, Boehringer Ingelheim GmbH, Eli Lilly and Company, Gilead Sciences, Inc., Merck Sharp & Dohme Corp., and Novartis Pharma AG, to emerging growth pharmaceutical and biotechnology companies, including Alkermes Inc., Alnylam Pharmaceuticals, Inc., bluebird bio, Inc., and Idorsia Pharmaceuticals Ltd. We also deliver solutions to companies in the consumer products industries.

Our Human Capital Resources

As of January 31, 2024, we had 7,172 employees worldwide, up by 428 from the previous year. Our employees in the United States are not represented by a labor union; however, in certain foreign locations, local workers’ councils represent our employees. We have not experienced any work stoppages, and we consider our relations with our employees to be very good.

Our workforce is diverse in many respects. As of January 31, 2024, 44% of our global employee population self-identified as female and approximately 42% of our U.S. workforce self-identified as members of underrepresented racial or ethnic groups. We define underrepresented racial or ethnic groups as those comprising individuals who identify as American Indian, Alaska Native, Asian, Black, African American, Hispanic, Latino, Hawaiian, Pacific Islander, or two or more races.

We use a combination of base salary and equity to compensate our employees. We also offer a range of benefits to our employees, including comprehensive healthcare and other wellness programs. We believe our compensation and benefits programs are competitive. We do not require any of our employees anywhere in the world to enter into non-compete agreements.

While we experience intense competition for talent, we believe we have been effective at attracting and retaining talented employees.

Research and Development

Our R&D organization is responsible for the design, development, and testing of our solutions and applications. Based on customer feedback and needs, we focus our efforts on developing new solutions, functionality, applications, and core technologies and further enhancing the usability, functionality, reliability, performance, and flexibility of existing solutions and applications.

Sales and Marketing

We sell our solutions through our direct sales organization. In large life sciences companies, the R&D and commercial business functions commonly have separate technology and business decision makers. Accordingly, we market and sell our solutions to align with the distinct characteristics of those decision makers. We have distinct R&D and commercial sales teams, which we further segment to focus on selling to large global life sciences companies and smaller life sciences companies. We also have product specific and industry specific sales teams for certain of our products.

Technology Infrastructure and Operations

Our products are hosted in data centers located in the United States, the United Kingdom, the European Union, Japan, South Korea, Australia, and Brazil. Our products used only within China are hosted in data centers located in China. We utilize third parties to provide our computing infrastructure and manage the infrastructure on which our solutions operate. For example, for Veeva CRM and certain of our multichannel CRM applications, we currently utilize the hosting infrastructure provided by Salesforce, Inc. For our Veeva Vault applications, including Vault CRM, and certain other Veeva Commercial Cloud applications, we utilize Amazon Web Services.

Our infrastructure providers employ advanced measures to ensure physical integrity and security, including redundant power and cooling systems, fire and flood prevention mechanisms, continual security coverage, biometric readers at entry points and anonymous exteriors. We also implement various disaster recovery measures such that data loss would be minimized in the event of a single data center disaster. We architect our solutions using redundant configurations to minimize service interruptions. We continually monitor our solutions for any sign of failure or pending failure, and we take preemptive action to attempt to minimize or prevent downtime.

Our technology is generally based on multitenant architectures that apply common, consistent management practices for all customers using our solutions. We enable multiple customers to share the same version of our solutions while securely partitioning their respective data. Veeva CRM and portions of our multichannel CRM applications currently utilize the Salesforce platform of Salesforce, Inc. Our Veeva Vault applications, including Vault CRM, and portions of our other Commercial Cloud applications are built upon our own proprietary platforms. Certain of our other applications rely on technology platforms provided by third parties. For example, our commercial data warehouse application utilizes Amazon Redshift and our digital engagement application utilizes Zoom.

Quality and Compliance Program

Veeva maintains a quality management system certified to ISO9001 to ensure process controls conform to established industry standards for our cloud software offerings that are subject to good practice regulations for the life sciences industry. Robust audit trail tracking, compliant electronic signature capture, data encryption, and secure access controls are required for these software offerings, and they must be thoroughly tested for compliance with applicable life sciences industry regulations, which include:

Privacy Program

Veeva maintains a data privacy program aligned to applicable laws such as the European Union’s General Data Protection Regulation (EU GDPR), the United Kingdom’s General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), and the U.S. Health Insurance Portability and Accountability Act (HIPAA). We have a Chief Privacy Officer who collaborates with our Chief Information Security Officer and business and product leaders throughout our organization. Our program focuses on the implementation of policies, procedures, and agreements to comply with applicable data privacy laws and regulations as well as data privacy requirements of customers and partners; the creation and maintenance of privacy documentation to demonstrate compliance with applicable data privacy laws and regulations, including legal transfer mechanisms; the process by which we obtain personal information through lawful and transparent means; the process by which we process personal information; the process by which we notify customers and data subjects in a timely manner in the event of a data breach, as required by contract or law; and the training of employees and contractors engaged in the processing of personal information. For more information about our privacy practices, please visit veeva.com/privacy.

Competition

The markets for our solutions are global, rapidly evolving, highly competitive, and subject to changing regulations, advancing technology, and shifting customer needs. In new sales cycles, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. The principal such competitor for our Veeva Commercial Cloud applications is IQVIA Holdings Inc., which offers a CRM application built on the Salesforce platform, various data products, and other applications that compete with our products.

Salesforce, Inc. has also announced their intention to offer a life sciences industry-specific CRM solution, which will likely compete with our offerings.

Our Veeva Data Cloud products as well as Veeva Crossix compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers.

No single vendor offers products that compete with all of our Veeva Development Cloud applications, but IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud applications.

Our Commercial Cloud and Development Cloud application suites also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Inc., Box, Inc., Amazon Web Services, or Microsoft—for certain of the functions our applications provide.

We sell certain of our Development Cloud applications to companies outside the life sciences industry. In this segment of our business, we compete with solutions such as those offered by OpenText, Microsoft, Honeywell, EtQ Management Consultants, LLC, Oracle, and Box, and custom-built software developed by third-party vendors or in-house by our potential customers.

Our business consulting and professional services offerings compete with a range of professional services firms.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business recognition, larger intellectual property portfolios, and agreements with a broader set of system integrators and other partners. We expect competition to intensify in the future, and we may face competition from new market entrants as well.

We believe the principal competitive factors in our market include the following:

• level of customer satisfaction;

• regulatory compliance verification and functionality;

• domain expertise with respect to life sciences;

• ease of deployment and use of solutions and applications;

• breadth and depth of solution and application functionality;

• brand awareness and reputation;

• modern and adaptive technology platform;

• capability for customization, configurability, integration, security, scalability and reliability of applications;

• total cost of ownership;

• ability to innovate and respond to customer needs rapidly;

• size of customer base and level of user adoption;

• ability to secure the rights to load and process third party proprietary data licensed by customers; and

• ability to integrate with legacy enterprise infrastructures and third-party applications.

We believe that we generally compete favorably on the basis of these factors.

Intellectual Property

We rely on a combination of patents, trade secrets, copyrights and trademarks, as well as contractual protections, to establish and protect our intellectual property rights. We have developed a process for seeking patent protection for our technology innovations. The table below provides a summary of our issued patents and pending patent applications as of January 31, 2024:

Our patents and patent applications cover technology within our Veeva Development Cloud, Veeva Commercial Cloud, and Veeva Data Cloud product families. We plan to continue expanding our patent portfolio. We require our employees, consultants, and other third parties to enter into confidentiality and proprietary rights agreements, and we control access to software, documentation, and other proprietary information. Although we rely on our intellectual property rights, as well as contractual protections to establish and protect our proprietary rights, we believe that factors such as the technological and creative skills of our personnel, creation of new features and functionality and frequent enhancements to our applications are essential to establishing and maintaining our technology leadership position as a provider of technology solutions to the life sciences industry.

Despite our efforts to protect our proprietary technology and our intellectual property rights, unauthorized parties may attempt to copy or obtain and use our technology to develop applications with the same functionality as our application. Policing unauthorized use of our technology and intellectual property rights is difficult, and protection of our rights through civil enforcement mechanisms may be expensive and time consuming, and may result in the impairment or loss of portions of our intellectual property.

Companies in our industry, as well as non-practicing entities, often own a number of patents, copyrights, trademarks, and trade secrets, and frequently enter into litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. We are currently engaged in legal proceedings with competitors in which the competitors are asserting trade secret misappropriation and other claims, and we may face new allegations in the future that we have infringed the patents, trademarks, copyrights, trade secrets, and other intellectual property rights of other competitors or non-practicing entities. We expect that we and others in our industry will continue to be subject to third-party infringement claims by competitors as the functionality of applications in different industry segments overlaps, and by non-practicing entities. Any of these third parties might make a claim of infringement against us at any time. For example, see the description of our current litigations in note 14 of the notes to our consolidated financial statements.

Corporate Information

Our website address is http://www.veeva.com. Information contained on our website is not incorporated by reference into this Form 10-K, and you should not consider information contained on our website to be part of this Form 10-K or in deciding whether to purchase shares of our common stock. Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended, are available free of charge on the Investors portion of our website at http://ir.veeva.com as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

Investing in our common stock involves a high degree of risk. You should consider carefully the risks and uncertainties described below and in “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” together with all of the other information in this report, including our consolidated financial statements and related notes, before investing in our common stock. The risks and uncertainties described below are not the only ones we face. If any of the following risks actually occurs, our business, financial condition, results of operations, and prospects could be materially and adversely affected. In that event, the price of our common stock could decline and you could lose part or all of your investment.

Summary of Risk Factors

The below is a summary of principal risks to our business and risks associated with ownership of our stock. It is only a summary. You should read the more detailed discussion of risks set forth below and elsewhere in this report for a more complete discussion of the risks listed below and other risks.

• If our security measures are breached or unauthorized access to customer data is otherwise obtained, our solutions may be perceived as not being secure, customers may reduce or stop the use of our solutions, and we may incur significant liabilities.

• The markets in which we participate are highly competitive, and if we do not compete effectively, our business and operating results could be adversely affected.

• If our newer solutions are not successfully adopted by new and existing customers, the growth rate of our revenues and operating results will be adversely affected.

• Our revenues are relatively concentrated within a small number of key customers, and the loss of one or more of such key customers could cause our revenues to decline.

• Our plans to migrate our customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

• Nearly all of our revenues are generated by sales to customers in the life sciences industry, and factors that adversely affect this industry could also adversely affect us.

• Over the longer term our revenue growth rates are likely to fluctuate from year to year and may decline, and, as our costs increase, we may not be able to sustain the same level of profitability we have achieved in the past.

• Unique and uncertain macroeconomic and geopolitical factors, including as a result of worldwide inflationary pressures and changes in interest rates, volatility in the financial sector, concerns about a possible domestic or global recession, currency exchange fluctuations, the Russian invasion of Ukraine, and the Israel-Hamas conflict may cause instability and volatility in the global financial markets, and disruptions within the life sciences industry that may negatively impact our business, our financial results, and our stock price.

• Difficulty attracting and retaining highly skilled employees could adversely affect our business and efforts to attract and retain such employees may increase our expenses.

• If the third-party providers of healthcare professional and healthcare organization data and prescription drug sales data, such as IQVIA for instance, do not allow our customers to upload and use such data in our solutions, the demand for our solutions may decrease, and our business may be negatively impacted.

• We rely on third-party providers for computing infrastructure, secure network connectivity, and other technology-related services needed to deliver our cloud solutions, and any disruption in the services provided by them could adversely affect our business and subject us to liability.

• Changing laws and regulations, including increasingly complex data privacy and information security regulations, in the U.S. and internationally, life sciences industry regulations, and trade policies, may impose additional costs for compliance, reduce demand for our solutions, and subject us to significant liabilities.

• We are currently being sued by third parties for alleged misappropriation of trade secrets. We may suffer damages, which could be significant, or other harm from these lawsuits and we may be sued for infringement or misappropriation of third-party intellectual property in the future.

• We may acquire other companies or technologies, which could divert our management’s attention, result in additional dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

Risks Related to Our Business

If our security measures are breached or compromised or unauthorized access to customer data is otherwise obtained, our solutions may be perceived as not being secure, customers may reduce or stop their use of our solutions, and we may incur significant liabilities.

Our solutions involve the storage, transmission, and other processing of our customers’ proprietary information (including personal or identifying information regarding their employees and the medical professionals whom their sales personnel contact, and sensitive proprietary data related to the clinical trial, regulatory submission and sales and marketing processes for medical treatments), personal information of medical professionals, personal information (which may include personal health information) of patients and clinical trial participants, and other sensitive information. For example, Veeva Crossix and Veeva Compass process third-party health and non-health data for U.S. patients. Additionally, we maintain and process other confidential, proprietary, and sensitive business information, including personal information relating to our employees and contractors and confidential information relating to our solutions and business.

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyber-attacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate access to or use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyber-attack and other sources of security breaches and incidents may be elevated as a result of Russia’s invasion of Ukraine, the Israel-Hamas conflict, or other geopolitical tensions or conflicts, due to an increase in cyber-attack attempts on us, our customers, our partners, or our technology infrastructure providers.

While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently and are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target. Moreover, our efforts to detect, prevent, and remediate known or unknown security vulnerabilities, including those arising from third-party hardware or software in our supply chain, may be insufficient to prevent security breaches or incidents resulting from such vulnerabilities, and may result in additional direct or indirect costs and liabilities and time of management and technical personnel. We may be required to expend significant capital and financial resources

Showing the first 8K of 121K characters. Open the full section

None.

We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

Governance

Our Board of Directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity events, and compliance with regulatory requirements and industry standards.

Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, reports to the EVP of Internal Operations and oversees our security team. Our CISO’s cybersecurity experience includes serving as an enterprise architect and network security architect at a Fortune 25 public retail company.

Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise.

Risks Management and Strategy

Information Security Management System

We maintain a comprehensive Information Security Management System (ISMS) that is designed to ensure the confidentiality, integrity, and availability of customer data, corporate data (such as intellectual property or source code), employee data, and our systems. Our ISMS is founded on the following industry-leading and regulatory standards:

• ISO 9001:2015 – Quality Management Systems

• ISO/IEC 27001:2013 – Information Security Management

• SOC2 Type II – System and Organization Controls

• SEI Capability Maturity Model Integration (v1.3)

• IT Infrastructure Library (ITIL) version 3

• ICH Q9 – Quality Risk Management

We have achieved ISO 27001 certification for our ISMS, which is managed by our CISO. As a data processor, we are the custodian of customer information that can be both confidential and sensitive. We are also certified to ISO 27018 for privacy controls.

Critical elements of our ISMS include:

• Operational measures to monitor and respond to data breaches and cyber attacks**. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities and protect our applications. Our personnel are trained to promptly report any security incident and any such incident is addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications.

• Vulnerability and penetration testing. Our solutions undergo internal vulnerability testing prior to release**. We have built our own internal penetration testing systems and we conduct vulnerability assessments on our software using automated and manual methods, at least annually. In addition, we commission annual vulnerability and penetration testing of our systems by industry-recognized, third-party security specialists.

• Training**. We require role-based security and security awareness training. All employees receive annual training on our Code of Conduct and our Acceptable Use Policy, which establishes our commitment to protecting the confidential and proprietary information of our customers and partners. In addition, all new hires and contractors must undergo information security awareness training. Subsequent security awareness training is required annually for all active employees and contractors. Employees in certain roles (e.g., customer support representatives, developers, and hiring managers) receive more extensive data security training annually.

• Disaster recovery and business continuity**. Our solutions are designed to help avoid single points of failure to reduce the chance of business disruption from security breaches, incidents, and other disruptions of systems. We maintain formally documented recovery processes that may be activated in the event of a significant business disruption of our corporate IT infrastructure or the production infrastructure that processes our customer data. We conduct testing, at least annually, to verify the validity of the recovery processes and provide reports on the test results for production infrastructure that processes our customer data to customers via access to a customer portal.

Process for Identifying Material Cybersecurity Incidents

Potentially material cybersecurity incidents are escalated according to our Security Incident Management Policy to a management response team comprising our EVP of Internal Operations, Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Privacy Officer, and Associate General Counsel (Corporate). Our Security Incident Management Policy is designed to inform the management response team about, and monitor, the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management response team is responsible for timely determining materiality and overseeing the appropriate reporting of certain cybersecurity incidents.

Cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats that we face, and regarding our likelihood of being materially affected by risks from cybersecurity threats, please see item 1A, “Risk Factors.”

Supplier Management Program

Through our Supplier Management Program, we maintain procedures that specify requirements for the assessment of suppliers and contractors who provide services that may impact our product and process quality. These procedures allow us to identify risks from potential cybersecurity incidents associated with our use of products and services from these suppliers and ensure that there is an appropriate level of oversight of our vendors’ quality systems. We perform initial audits and then periodic, risk-based audits on our suppliers to ensure their products and services conform to our established quality standards.

We own our Pleasanton, California corporate headquarters, which currently accommodates our principal executive and significant portions of our product development, engineering, marketing, finance, and legal organizations. We expect that our corporate headquarters will support the overall growth of our business for the near term.

We also lease offices in various locations, including North America, Europe, Asia Pacific, and Latin America. We expect to expand our facilities capacity in certain field locations during our fiscal year ending January 31, 2025 and may further expand our facilities capacity after January 31, 2025 as our employee base grows. We believe that we will be able to obtain additional space on commercially reasonable terms. See note 10 of the notes to our consolidated financial statements included elsewhere in this Annual Report on Form 10-K for more information about our lease commitments.

From time to time, we may be involved in legal proceedings and subject to claims incident to the ordinary course of business. For information regarding certain current legal proceedings, see note 14 of the notes to our consolidated financial statements, which is incorporated herein by reference. In addition to the legal proceedings referenced in note 14, we are involved in the following additional legal proceedings which may be material to our business.

California Non-Compete Matter

On July 17, 2017, we filed a complaint in the Superior Court of the State of California in the County of Alameda against Medidata, IQVIA, and Sparta Systems, Inc. (Veeva Systems Inc. v. Medidata Solutions, Inc., Quintiles IMS Incorporated, IMS Software Services, LTD., and Sparta Systems, Inc., Case No. RG17868081). Our lawsuit seeks declaratory and injunctive relief concerning the use of non-compete, confidentiality, and non-disparagement agreements by these companies. Since the original complaint was filed, there has been extensive requests to the court for rulings on contested questions.

Among other things, Medidata and Sparta appealed the superior court’s decisions finding that the case may proceed as to some causes of action, and Veeva cross-appealed the superior court’s ruling that certain causes of action were barred under California law. On March 10, 2022, the California Court of Appeal affirmed the decision of the superior court, ruling that certain of Veeva's claims may proceed and certain of its claims may not. This decision is now final. On October 31, 2019, as to Veeva's claims against IQVIA, the trial court's earlier dismissal was reversed by the court of appeal and the case was reassigned to a new trial court judge. On June 9, 2023, IQVIA filed a counter-complaint seeking a declaration that its non-compete agreements comply with California law. Discovery is proceeding and no trial date has been set.

On February 13, 2023, Veeva and Sparta entered into a confidential settlement agreement dismissing their claims against each other. On January 16, 2024, Veeva and Medidata also entered into a confidential settlement agreement dismissing their claims against each other. The only defendant now in the case is IQVIA.

Although the results of legal proceedings and claims cannot be predicted with certainty, we believe we are not currently a party to any other legal proceedings, the outcome of which, if determined adversely to us, would individually or taken together have a material adverse effect on our business, operating results, cash flows, or financial position. Regardless of the outcome, such proceedings can have an adverse impact on us because of defense and settlement costs, diversion of resources and other factors, and there can be no assurances that favorable outcomes will be obtained.

Not applicable.

PART II.

Market Price of Common Stock

Our common stock is listed on the New York Stock Exchange under the symbol “VEEV.”

Stockholders

As of January 31, 2024, we had 21 holders of record of our common stock. The actual number of holders of common stock is greater than this number of record holders and includes stockholders who are beneficial owners but whose shares are held in street name by brokers and other nominees. This number of holders of record also does not include stockholders whose shares may be held in trust by other entities.

Purchases of Equity Securities by the Issuer and Affiliated Purchasers

None.

Recent Sales of Unregistered Securities

None.

Stock Performance Graph

This performance graph shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (Exchange Act), or incorporated by reference into any of our other filings under the Exchange Act or the Securities Act except to the extent we specifically incorporate it by reference into such filing.

This chart compares the cumulative total return on our common stock with that of the S&P 500 Index and the S&P 1500 Application Software Index. The chart assumes $100 was invested at the close of market on January 31, 2019 in the common stock of Veeva Systems Inc., the S&P 500 Index, and the S&P 1500 Application Software Index and assumes the reinvestment of any dividends. The stock price performance on the following graph is not necessarily indicative of future stock price performance.

You should read the following discussion and analysis of our financial condition and results of operations in conjunction with our consolidated financial statements and notes thereto appearing elsewhere in this report. In addition to historical consolidated financial information, the following discussion and analysis contains forward-looking statements that involve risks, uncertainties, and assumptions. Our actual results could differ materially from those anticipated by these forward-looking statements as a result of many factors. We discuss factors that we believe could cause or contribute to these differences below and elsewhere in this report, including those set forth under “Risk Factors” and “Special Note Regarding Forward-Looking Statements.”

Overview

Veeva is the leading provider of industry cloud solutions for the global life sciences industry. Our offerings span cloud software, data, analytics, professional services, and business consulting and are designed to meet the unique needs of our customers and their most strategic business functions—from research and development through commercialization. Our solutions help life sciences companies develop and bring products to market faster and more efficiently, market and sell more effectively, and maintain compliance with government regulations.

Our solutions are grouped into three major product categories —Veeva Development Cloud, Veeva Commercial Cloud, and Veeva Data Cloud. Veeva Data Cloud is comprised of our data offerings, including Veeva Compass, Veeva Link, and Veeva OpenData. For financial reporting purposes, revenues associated with our Veeva Commercial Cloud, Veeva Data Cloud, and Veeva Claims solutions are classified as “Commercial Solutions” revenues, and revenues associated with our Veeva Development Cloud, Veeva RegulatoryOne, and Veeva QualityOne solutions are classified as “R&D Solutions” revenues.

In our fiscal year ended January 31, 2024, we derived approximately 52% and 48% of our subscription services revenues and 50% and 50% of our total revenues from our Commercial Solutions and R&D Solutions, respectively. For the fiscal year ended January 31, 2023, we derived approximately 55% and 45% of our subscription services revenues and 52% and 48% of our total revenues from our Commercial Solutions and R&D Solutions, respectively. Revenues associated with our R&D Solutions are expected to continue to increase as a percentage of both subscription services revenues and total revenues in the future. We also offer certain of our R&D Solutions to industries outside the life sciences industry primarily in North America and Europe.

For our fiscal years ended January 31, 2024, 2023, and 2022, our total revenues were $2,364 million, $2,155 million, and $1,851 million, respectively, representing year-over-year growth in total revenues of 10% in our fiscal year ended January 31, 2024, and 16% in our fiscal year ended January 31, 2023. For our fiscal years ended January 31, 2024, 2023, and 2022, our subscription services revenues were $1,902 million, $1,733 million, and $1,484 million, respectively, representing year-over-year growth in subscription services revenues of 10% in our fiscal year ended January 31, 2024, and 17% in our fiscal year ended January 31, 2023. We generated net income of $526 million, $488 million, and $427 million for our fiscal years ended January 31, 2024, 2023, and 2022, respectively.

As of January 31, 2024, 2023, and 2022, we served 1,432, 1,388, and 1,205, customers, respectively. As of January 31, 2024, 2023, and 2022, we had 693, 684 and 653 Commercial Solutions customers, respectively, and 1,078, 1025, and 860 R&D Solutions customers, respectively. These customer count totals are net of customer attrition during each period. The combined customer counts for Commercial Solutions and R&D Solutions exceed the total customer count in each year because some customers subscribe to products in both areas. Commercial Solutions consist of our cloud software, data, and analytics products built specifically to more efficiently and effectively commercialize our customers’ products. R&D Solutions consist of our clinical, quality, regulatory, and safety products. Many of our applications for R&D are used by smaller, earlier stage, pre-commercial companies, some of which may not reach the commercialization stage. Thus, the potential number of R&D Solutions customers is higher than the potential number of Commercial Solutions customers.

Components of Results of Operations

Revenues

We derive our revenues primarily from subscription services fees and professional services fees. Subscription services revenues consist of fees from customers accessing our cloud-based software solutions and fees for our data solutions. Professional services and other revenues consist primarily of fees from implementation services, configuration, data services, training, and managed services related to our solutions and services related to our Veeva Business Consulting offering. For the fiscal year ended January 31, 2024, subscription services revenues constituted 80% of total revenues and professional services and other revenues constituted 20% of total revenues.

We generally enter into master subscription agreements with our customers and count each distinct master subscription agreement that has not been terminated or expired and that has orders for which we have recognized revenue in the quarter as a distinct customer for purposes of determining our total number of current customers as of the end of that quarter. We generally enter into a single master subscription agreement with each customer, although in some instances, affiliated legal entities within the same corporate family may enter into separate master subscription agreements. Conversely, affiliated legal entities that maintain distinct master subscription agreements

may choose to consolidate their orders under a single master subscription agreement, and, in that circumstance, our customer count would decrease. Divisions, subsidiaries, and operating units of our customers often place distinct orders for our subscription services under the same master subscription agreement, and we do not count such distinct orders as new customers for purposes of determining our total customer count. For purposes of determining customers of Veeva Crossix that do not contract under a master subscription agreement, we count each entity that has a statement of work or services agreement and a recurring known payment obligation as a distinct customer if such entity is not otherwise a customer of ours. For Veeva Crossix, we do not count as distinct customers agencies contracting with us on behalf of brands within life sciences companies.

New subscription orders for our Veeva CRM application generally have a one-year term. If a customer adds end users or additional Commercial Solutions to an existing order for our Veeva CRM application, such additional orders will generally be coterminous with the anniversary date of the Veeva CRM order, and as a result, orders for additional end users or additional Commercial Solutions will commonly have an initial term of less than one year.

Particularly with respect to our R&D Solutions, we have entered into a number of orders with multi-year terms. The fees associated with such orders are typically not based on the number of end-users and typically escalate over the term of such orders at a pre-agreed rate to account for, among other factors, implementation and adoption timing and planned increased usage by the customer. When such multi-year orders are non-cancellable (other than for cause), we recognize the total contracted revenue ratably over the multi-year

Showing the first 8K of 61K characters. Open the full section

Foreign currency exchange risk

Our results of operations and cash flows are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Euro, Japanese Yen, Canadian Dollar, British Pound Sterling, Chinese Yuan, and Hungarian Forint, and may be adversely affected in the future due to changes in foreign currency exchange rates. For example, changes in exchange rates negatively affected our revenues as expressed in U.S. dollars for the fiscal year ended January 31, 2024. Additionally, changes in exchange rates had a largely offsetting impact on operating income for the fiscal year ended January 31, 2024. For the fiscal year ended January 31, 2024, about 83% of our revenues and about 80% of our expenses were denominated in USD, respectively.

We have also experienced and will continue to experience foreign currency fluctuations due to the periodic re-measurement of monetary account balances that are denominated in currencies other than the functional currency of the entities in which they are recorded and such fluctuations can impact our net income. We engage in the hedging of our foreign currency transactions as described in note 7 of the notes to our consolidated financial statements and may, in the future, hedge selected significant transactions or net monetary exposure positions denominated in currencies other than the U.S. dollar. Realized foreign currency gains, primarily resulting from the re-measurement of monetary account balances offset by the foreign currency hedges, were $3 million and unrealized foreign currency losses were $4 million for the fiscal year ended January 31, 2024. For the fiscal year ended January 31, 2023, we had realized foreign currency gains of $4 million and unrealized foreign currency losses of $4 million.

Interest rate sensitivity

We had cash, cash equivalents and short-term investments totaling $4.0 billion as of January 31, 2024. This amount was held primarily in demand deposit accounts, money market funds, U.S. treasury securities and agency obligations, corporate notes and bonds, asset-backed securities, commercial paper, and foreign government bonds. The cash and cash equivalents are held for working capital purposes and other operational activities. We do not enter into investments for trading or speculative purposes.

Our cash equivalents and our portfolio of marketable securities are subject to market risk due to changes in interest rates, which could affect our results of operations. Fixed rate securities may have their market value adversely affected due to a rise in interest rates, while floating rate securities may produce less income than expected if

interest rates fall. Due in part to these factors, our future investment income may fluctuate due to changes in interest rates or we may suffer losses in principal if we are forced to sell securities that decline in market value due to changes in interest rates. However, because we classify our marketable securities as “available for sale,” no gains or losses are recognized due to changes in interest rates unless such securities are sold prior to maturity or declines in fair value are determined to be other-than-temporary. Our fixed-income portfolio is subject to interest rate risk.

An immediate increase of 100-basis points in interest rates would have resulted in a $43 million market value reduction in our investment portfolio as of January 31, 2024. An immediate decrease of 100-basis points in interest rates would have increased the market value by $43 million as of January 31, 2024. This estimate is based on a sensitivity model that measures market value changes when changes in interest rates occur. Fluctuations in the value of our investment securities caused by a change in interest rates (gains or losses on the carrying value) are recorded in other comprehensive income, and are realized only if we sell the underlying securities.

VEEVA SYSTEMS INC.

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

Report of Independent Registered Public Accounting Firm

To the Stockholders and Board of Directors

Veeva Systems Inc.:

Opinions on the Consolidated Financial Statements and Internal Control Over Financial Reporting

We have audited the accompanying consolidated balance sheets of Veeva Systems Inc. and subsidiaries (the Company) as of January 31, 2024 and 2023, the related consolidated statements of comprehensive income, stockholders’ equity, and cash flows for each of the years in the three-year period ended January 31, 2024, and the related notes (collectively, the consolidated financial statements). We also have audited the Company’s internal control over financial reporting as of January 31, 2024, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of January 31, 2024 and 2023, and the results of its operations and its cash flows for each of the years in the three-year period ended January 31, 2024, in conformity with U.S. generally accepted accounting principles. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of January 31, 2024 based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Annual Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audit of the consolidated financial statements included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audit also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matter

The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the consolidated financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of a critical audit matter does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

Evaluation of the sufficiency of audit evidence over revenue

As discussed in Note 1 to the consolidated financial statements, the Company recorded $2.363 million of total revenues for the year ended January 31, 2024, of which $1.901 million was subscription services related, and $462 m

Showing the first 8K of 139K characters. Open the full section

Not applicable.

(a) Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of January 31, 2024. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (Exchange Act), means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the Securities and Exchange Commission’s (SEC) rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate, to allow timely decisions regarding required disclosure. Based on the evaluation of our disclosure controls and procedures as of January 31, 2024, our Chief Executive Officer and Chief Financial Officer concluded that, as of such date, our disclosure controls and procedures were effective at the reasonable assurance level.

(b) Management’s Annual Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act). Our management conducted an assessment of the effectiveness of our internal control over financial reporting as of January 31, 2024 based on the criteria set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on the assessment, our management has concluded that our internal control over financial reporting was effective as of January 31, 2024 to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. GAAP. Our independent registered public accounting firm, KPMG LLP, has issued an audit report with respect to our internal control over financial reporting, which appears in Part II, Item 8 of this Form 10-K.

(c) Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the fiscal quarter ended January 31, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

(d) Inherent Limitations on Effectiveness of Controls

Our management, including our Chief Executive Officer and Chief Financial Officer, do not expect that our disclosure controls or our internal control over financial reporting will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been or would be detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by management override of the controls. The design of any system of controls is also based in part upon certain assumptions about the likelihood of future events, and there can be no assurance

that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

Rule 10b5-1 Trading Plans

The following table sets forth the material terms of all “Rule 10b5-1 trading arrangements” (as such term is defined under Item 408(a) of Regulation S-K) adopted, modified, or terminated by our Section 16 officers and directors during the fiscal quarter ended January 31, 2024:

(1) This number represents the maximum number of shares of common stock that may be sold pursuant to the trading plan. The number of shares actually sold will depend on the satisfaction of certain conditions as set forth in the plan.

(2) The trading plan may expire on an earlier date if and when all transactions thereunder are completed.

None of our Section 16 officers or directors adopted, modified, or terminated a “non-Rule 10b5-1 trading arrangement” (as such term is defined under Item 408(c) of Regulation S-K) during the fiscal quarter ended January 31, 2024.

Not Applicable.

PART III.

The information required by this item will be contained in our definitive proxy statement to be filed with the Securities and Exchange Commission in connection with our 2024 Annual Meeting of Stockholders (Proxy Statement), which we expect to file not later than 120 days after the end of our fiscal year ended January 31, 2024, and is incorporated in this report by reference.

The information required by this item will be set forth in the Proxy Statement, which we expect to file not later than 120 days after the end of our fiscal year ended January 31, 2024 and is incorporated in this report by reference.

The information required by this item will be set forth in the Proxy Statement, which we expect to file not later than 120 days after the end of our fiscal year ended January 31, 2024 and is incorporated in this report by reference.

The information required by this item will be set forth in the Proxy Statement, which we expect to file not later than 120 days after the end of our fiscal year ended January 31, 2024 and is incorporated in this report by reference.

The information required by this item will be set forth in the Proxy Statement, which we expect to file not later than 120 days after the end of our fiscal year ended January 31, 2024 and is incorporated in this report by reference.

PART IV.

(a) Documents Filed. The following documents are filed as part of, or incorporated by reference into, this Form 10-K:

1. Financial Statements. See Index to Consolidated Financial Statements under Item 7 of this Form 10-K.

2. Financial Statement Schedules. All schedules have been omitted because the information required to be presented in them is not applicable or is shown in the consolidated financial statements or related notes.

3. Exhibits. We have filed, or incorporated into this Form 10-K by reference, the exhibits listed on the accompanying Exhibit Index immediately preceding the signature page of this Form 10-K.

(b) Exhibits. See Item 15(a)(3) above.

(c) Financial Statement Schedules. See Item 15(a)(2) above.

A Form 10-K summary is provided at the beginning of this document, with hyperlinked cross-references. This allows users to easily locate the corresponding items in this Form 10-K, where the disclosure is fully presented. The summary does not include certain Part III information that is incorporated by reference to the Proxy Statement.

EXHIBIT INDEX

• Indicates a management contract or compensatory plan.

** Portions of this exhibit (indicated by asterisks) have been omitted pursuant to an order granting confidential treatment. Omitted portions have been submitted separately to the Securities and Exchange Commission (SEC).

† The certifications attached as Exhibit 32.1 and 32.2 that accompany this Form 10-K are not deemed filed with the SEC and are not to be incorporated by reference into any filing of Veeva Systems Inc. under the Securities Act of 1933, as amended (Securities Act), or the Securities Exchange Act of 1934, as amended (Exchange Act), whether made before or after the date of this Form 10-K, irrespective of any general incorporation language contained in such filing.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this Annual Report on Form 10-K to be signed on its behalf by the undersigned, thereunto duly authorized, in the City of Pleasanton, State of California, on this 25th day of March, 2024.

POWER OF ATTORNEY

KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below hereby constitutes and appoints Peter P. Gassner and Brent Bowman, and each of them, as his or her true and lawful attorney-in-fact and agent with full power of substitution, for him or her in any and all capacities, to sign any and all amendments to this Annual Report on Form 10-K, and to file the same, with all exhibits thereto and other documents in connection therewith, with the SEC, granting unto said attorney-in-fact and agent full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully for all intents and purposes as he or she might or could do in person, hereby ratifying and confirming all that said attorney-in-fact and agent, or his substitute, may lawfully do or cause to be done by virtue hereof.

Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, this Annual Report on Form 10-K has been signed by the following persons in the capacities and on the dates indicated.