Willdan Group

None of the warning signs we check for were found.

We look for five warning signs: doubt it can keep going, weak checks on its own accounts, a notice that its past accounts can't be relied on, a change of auditor, and one customer bringing in a big share of sales. We don't check lawsuits, investigations or debt yet.

We checked the auditor's report, internal controls, restatement notices, auditor changes and big customers in the 10-K filed 27 Feb 2026, plus the 10-Q filed 7 Aug 2026 and 4 later 8-Ks.

Cheap for a reason is the question the numbers cannot answer.

Whether the price already reflects the risks is what the deep dive is for.

• Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.

  Could happen

  In the ordinary course of business, we have been and may be in the future be targeted by malicious cyber-attacks. Cybersecurity attacks in particular are evolving, and we and the third parties with whom we work face the constant risk of cybersecurity threats, including, among other things, computer viruses, malicious code, social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software and hardware failures, attacks enhanced or facilitated by AI, and other electronic security breaches that could lead to disruptions in critical systems, unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, encryption, access to, release or other compromise of confidential or sensitive information. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to material adverse consequences. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

  Read moreShow less

• Our backlog is subject to cancellation, adjustments and changing economic conditions and is an uncertain indicator of future operating results.

  Could happen

  We include in backlog the future revenue we expect to receive from our contracts with clients. For contracts without specified funding ceilings, which comprise a small percentage of our contracts, backlog is reported as expected revenue for up to one year. For contracts with specified funding ceilings, which comprise most of our contracts, we report the unused, or unrecognized, revenue ceiling, adjusted downward if we expect to ultimately recognize less revenue than the unused revenue ceiling, as the amount of backlog. We cannot guarantee that the revenue projected in our backlog will be realized or, if realized, will result in profits. In addition, project delays, suspensions, terminations, cancellations, reductions in scope, or other adjustments do occur from time to time in our industry due to considerations beyond our control and may have a material impact on the value of reported backlog with a corresponding adverse impact on future revenues and profitability. For example, most of our contracts include a provision allowing for termination for convenience after reimbursement of any unbilled effort under the contract. In the event that this occurs, any remaining contract value is removed from our backlog. These types of backlog reductions could adversely affect our revenue and margins. As a result of these factors, our backlog as of any particular date is an uncertain indicator of our future earnings.

  Read moreShow less

• Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.

  In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Furthermore, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.

  Read moreShow less

• Data privacy risks, including evolving laws, regulations, and other obligations, may result in business interruption and increased costs and liabilities.

  Could happen

  Laws, regulations and other obligations (including without limitation applicable guidance, industry standards, external and internal privacy and security policies and statements, and contractual requirements) relating to personal data and data privacy are constantly evolving, as federal, state, local and foreign governments adopt new measures addressing data privacy. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These laws impose stringent obligations. For example, the California Consumer Privacy Act, as amended (“CCPA”), which applies to business representative and other types of personal data of California residents, provides for fines of up to $7,988 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

  Read moreShow less