Booz Allen Hamilton Holding Corp (BAH)

How it makes money

Revenue comes from government contracts and task orders, billed mostly as hours worked plus reimbursed expenses. The 10-K describes three contract structures: cost-reimbursable (Booz Allen is repaid allowable costs up to a ceiling plus a fee), time-and-materials (negotiated hourly rates plus expenses), and fixed-price (a set price for a defined outcome, with higher margin potential but the full risk of cost overruns). Work is won mainly through large multi-award vehicles known as IDIQ contracts: in fiscal 2026 roughly 84% of revenue came from 2,426 active task orders under such vehicles, and the single largest vehicle accounted for about 17% of revenue. The 10-K notes the US government is directing agencies to use firm-fixed-price contracts more often for new awards, which shifts cost risk onto the contractor. Total backlog at 31 March 2026 was $38.2 billion, of which only $4.3 billion was funded.

Revenue by segment

Booz Allen's advantage is regulatory and relational rather than technological. About 77% of its staff hold US security clearances, which take time and government sponsorship to obtain and cannot be bought or replicated quickly by a new entrant. Roughly 84% of revenue runs through IDIQ contract vehicles, and simply being on a vehicle is a precondition for bidding on the work underneath it, so incumbency compounds. Against that, the customer is a single, price-conscious buyer that recompetes work, can protest or be protested against, and is pushing fixed-price terms; fiscal 2026 showed how fast revenue can fall when that buyer changes its priorities. The advantage is real but bounded — narrow, not wide.

Demand does not follow the consumer or industrial economy — it follows the federal budget. That makes Booz Allen largely indifferent to recessions, but exposed to a political cycle of its own: appropriations, continuing resolutions, administration priorities and procurement pace. Fiscal 2026 is the demonstration. Group revenue fell 6.4% and headcount dropped by 4,300 people, which the company attributes to a slowed procurement and funding environment. The damage was concentrated: Civil revenue fell from $4,170 million to $3,248 million, while Defense and Intelligence both grew slightly. So national-security work behaves defensively, and civil-agency work can swing hard when Washington changes its mind.

Key risks

• Dependence on US government spending and mission priorities — The company expects to keep deriving the vast majority of its revenue from US Government contracts. Changes in the level of federal spending, in budget priorities, in appropriations timing or in the missions agencies choose to fund can reduce or delay work already won.
• Backlog may not turn into revenue — The 10-K warns that backlog may not convert into actual revenue because of congressional appropriations, programme changes or contract cancellations. Only $4.3 billion of the $38.2 billion backlog at 31 March 2026 was funded; the rest depends on future funding decisions and on options the government is free not to exercise.
• Competitive bidding, recompetes and protests — Contracts are periodically recompeted. The company lists as risks its ability to compete effectively for new work, protests filed by competitors against awards it wins, and the loss of GSA schedules or positions on government-wide acquisition contracts, any of which can remove a revenue stream at a stroke.
• Shift in contract mix toward fixed price — The 10-K notes the US government is directing agencies to increase the use of firm-fixed-price contracts for new awards. Under fixed price Booz Allen bears the full impact of cost overruns, so errors in estimating costs translate directly into lost margin.
• Attracting and keeping cleared people — The business is its workforce. The company lists the ability to attract and retain employees, and to obtain and maintain their security clearances, among its principal risks, along with the loss of senior management and gaps in leadership development.
• Government contracting rules, audits and False Claims Act exposure — Booz Allen must comply with the Federal Acquisition Regulation, DFARS, the Cost Accounting Standards and the False Claims Act, and with limits on which compensation costs can be reimbursed. Non-compliance, misconduct by an employee, subcontractor or supplier, or an adverse legal or regulatory proceeding can lead to penalties, disallowed costs or suspension from government work.
• Cybersecurity and internal systems — The company identifies failures of its internal systems and breaches of its information security — including of its financial management system — as risks, alongside compliance with data privacy and cybersecurity laws and the risks of developing and deploying artificial intelligence.
• Substantial indebtedness — Item 1A flags the company's substantial debt, its ability to refinance it, and the restrictions its debt agreements place on how it can operate and deploy capital.

Top customers account for 10% of revenue

The figure is the single largest customer, not a top-ten total: the 10-K states that the Department of Veterans Affairs was the largest customer in fiscal 2026, accounting for 10% of revenue. The filing does not give a combined share for the top customers. The deeper concentration is on the buyer itself — the company expects to keep deriving the vast majority of revenue from the US Government, so its many agency relationships ultimately depend on one payer. Concentration also shows up through contract vehicles: about 84% of revenue came through IDIQ vehicles, the largest of which represented roughly 17% of revenue, while the largest individual task order was about 4% and the largest definite contract about 1%.