Limited Risk Disclosure Updates Despite Political and Economic Volatility

The pace of change in the external risk environment has been unrelenting over the past 12 months, as US companies have faced an unprecedented and highly dynamic set of external drivers impacting their businesses. These drivers have included significant political and regulatory shifts, a complex business environment combining low economic optimism and high interest rates with fairly stable economic growth and labor markets, ongoing and mutating global conflicts and other geopolitical challenges, and substantial disruptions in the global trade environment.

Deloitte and the USC Marshall School of Business Peter Arkley Institute for Risk Management (USC Marshall Peter Arkley Institute for Risk Management) have completed our fifth year of analysis of annual risk factor disclosures of Standard & Poor’s (S&P) 500 companies. Although the Securities and Exchange Commission (SEC) sought to reduce the volume of risk factor disclosures in its 2020 risk reporting reforms, companies have provided lengthier risk factor disclosures this past reporting season reflecting this complex and dynamic environment.

This year, we also conducted a review of the first quarterly reports filed after April 2, 2025 to understand whether companies chose to update their risk factors to reflect any material changes since the filings of their annual reports, an update required by SEC regulations. In fact, over 75% of companies did not update their risk factor disclosures. However, 94 companies did, either restating their risk factors in their entirety or disclosing one to seven stand-alone risk factors. As expected, many of these updated risk factors related to evolving trade policies, government funding and/or contracting, and corporate sustainability reporting.

Background

Deloitte and the USC Marshall Peter Arkley Institute for Risk Management published our initial risk factor disclosures analysis in March 2021, Many companies struggle to adopt spirit of amended SEC risk disclosure rules. We concluded that risk factor disclosures of S&P 500 companies were becoming lengthier, contravening the SEC’s stated intention in the amended requirements. For a description of these requirements, see Appendix: Summary of SEC’s Final Rule on Regulation S-K, Item 105.

Follow-up reports in November 2021, December 2022, and November 2023 confirmed our initial March 2021 analysis and showed a continuing trend toward lengthier disclosures. Our October 2024 report showed that disclosures were stabilizing, growing minimally in page count and risk factor count.

In this latest report, we have reviewed the risk factor disclosures in the annual reports of 427 S&P 500 companies to identify trends during this fifth year of implementation. We also have reviewed the first quarterly reports filed after April 2, 2025 to understand whether companies chose to update their risk factors to reflect any material changes since the filings of their annual reports. Finally, we have provided some high-level considerations for companies as they prepare for the next reporting season.

Analysis of rules adoption

To assess the adoption of the amended requirements over five years of implementation, we have reviewed the risk factor disclosures of 427 S&P 500 companies that have filed five annual reports between November 9, 2020, the effective date of these requirements, and May 9, 2025. Our key findings are as follows:

• The number of pages has increased by nearly a half page over the past year.
  • The average number of pages is about 14.3 per company. Over 56% of companies increased the number of pages this past year.

• The number of risk factors has stabilized over the past five years.
  • The average number of risk factors per company was 32. Even with the number of risk factors stabilizing, 37% of companies still increased the number of risk factors this past year.

• Most companies did not need to include a risk factor summary, which is required if the risk factors disclosure is longer than 15 pages.
  • Approximately 28% included a summary in the fifth year of implementation up from 25% in the fourth year of implementation.
  • The average number of pages for the summaries was approximately 1.6 pages the fifth year of implementation with a range of .5 to 2.5 pages, the same as the fourth year of implementation.

• Headings are being used, but they are often very generic.
  • Over 50% of companies used the same number of headings all five years of implementation.
  • The average number of headings per company was five all five years of implementation.

• • The average number of risk factors per heading was six all five years of implementation. Seventy-five companies had significantly more—20 to as many as 54 risk factors under one heading during the fifth year of implementation. One of those 75 companies had two headings with 20 or more risk factors.

• • The most common heading categories this fifth year of implementation were variants of legal, regulatory, and compliance; business; operational; financial; cybersecurity, information technology, data security, privacy; common stock; economic and macroeconomic conditions; indebtedness; strategic transactions; industry; strategic; human capital; intellectual property; market; international operations; and tax and accounting.
• Nearly one-third of companies used a “general risk factors” heading during each of the past five years, contrary to the SEC’s advice.
  • Companies used an average of approximately five risk factors under the general risk factors heading all five years of implementation and a range of one to 17 during the fifth year.

• • The most common risk factors included under the general risk factors heading during this fifth year of implementation were natural and man-made disasters/catastrophes; economic conditions; recruitment and retention of talent/key personnel; stock price volatility; litigation; climate change; cybersecurity; financial reporting internal control weakness; tax law and regulation changes; dividends and stock repurchases; and reputation.

Insights on quarterly report risk factors updates

The first months of the second Trump Administration have been highly dynamic with several executive orders issued on trade policy, including tariffs which have often inspired reciprocal tariffs from other countries. Amidst this environment, many of the S&P 500 companies filed their annual reports disclosing their material risks and a few months later their quarterly reports. SEC regulations require companies to update their annual report risk factor disclosures with any material changes in their quarterly reports.

To understand whether companies updated their risk factors to reflect any material changes, we reviewed the risk factor disclosures in the annual reports filed between November 9, 2024 and May 9, 2025 and the first quarterly reports filed after April 2, 2025 by 427 S&P 500 companies.

In fact, only one-quarter of the 427 companies reviewed reported material changes and updated their risk factor disclosures.

Of these 94, 30 companies restated their risk factors in their entirety in their quarterly reports.

When these 30 companies restated their risk factors, they amended between six and 44 risk factors as compared to their annual reports. Twenty-one of these 30 companies amended less than 20.

Twenty-nine of these 30 companies amended risk factors mentioning trade policy, 13 companies mentioning government funding and/or contracting, and 17 companies mentioning corporate sustainability reporting.

Sixty-four companies updated their risk factor disclosures (not by restating their disclosures in their entirety) but including just one to seven stand-alone risk factors in the quarterly report and incorporating the annual report risk factor disclosure by reference. Two-thirds of companies included one risk factor and the rest included two to seven risk factors.

Of these 64 companies, 52 disclosed risk factors mentioning trade policy, seven companies mentioning government funding and/or contracting, and two companies mentioning corporate sustainability reporting.

Most companies—333 of 427—reported no changes in their risk factor disclosures.

About two-thirds of these 333 companies explicitly reported no “material” changes to the risk factors since the annual reporting filing. Five companies reported no “material” changes since the annual report filing except those reported in other quarterly report sections, such as in the Management’s Discussion and Analysis of Financial Condition and Results of Operations in the quarterly report. Two companies reported no “material” changes since the annual report and subsequent filings. One company disclosed that the annual report included the “material” risk factors, but did not explicitly say there we no “material” changes.

About one-fifth of these 333 companies referenced their annual reports and often their quarterly reports, but did not explicitly state there were no “material” changes since these filings. About eight percent of companies did not include any risk factors section. Four companies reported no “significant” changes since the annual report filing. One company reported no changes; one company stated no changes were required to be reported; one company reported no “material” changes and referenced no other filing; one company reported the risk factors disclosure as “not applicable;” and another included a bullet list of risk factors.

Considerations

Update risk factor disclosures in quarterly reports. Companies should assess as they prepare their quarterly reports whether their risk factors have materially changed. If so, SEC regulations require an update. Although there is limited SEC guidance on updating quarterly risk factor disclosures, the SEC stated when it issued the rule requiring these updates for material changes that, “[t]he amendments do not otherwise require, and we discourage, unnecessary restatement or repetition of risk factors in quarterly reports.” For readability purposes, companies should consider only including risk factors that they amended and reference the appropriate SEC filing(s) rather than restating their risk factors in their entirety.

Integrate external risk factor disclosure processes with internal enterprise risk management (ERM) reporting processes. As we have mentioned in each of our past reports, companies can consider integrating their external risk factor disclosure process into their internal ERM reporting processes. As ERM leading practices evolve to providing quarterly updates on top risks to leadership, effective linkage with SEC reporting processes can enable pertinent updates in securities filings. Companies may then be better positioned to meet the SEC’s goals set forth in the amended risk factor disclosure requirements of “disclosure that is more in line with the way the registrant’s management and its board of directors monitor and assess the business.”

Aim for specificity, avoid boilerplate. Companies should strive to make their risk factor disclosures more specific when describing their material risks. This advice aligns with the spirit of the SEC’s amended risk factor disclosure requirements regarding all material risks.

Use risk taxonomies from ERM program for headings. To bring more specificity to headings (which often are generic) and enhance readability, companies could rely on their internal taxonomies used to catalogue risks for their ERM and risk reporting to management and boards of directors. Companies could also use external taxonomies promulgated by regulators and/or professional organizations. Using more specific headings could lead to the more integrated external and internal reporting the SEC has sought.

Shorten sentence length. We have now reviewed five reporting seasons of risk factor disclosures since the effective date of the SEC’s risk factor disclosure reforms. The sentence length in most of these disclosures remains exceedingly lengthy, reducing readability. As we have stated in several of our past reports, companies would serve the investing public well by decreasing the number of words in each sentence. Plain English standards call for no more than 20 words per sentence.

Conclusion

During this fifth year of implementation of the SEC’s amended requirements, risk factor disclosures of 427 S&P 500 companies have continued to lengthen. Given the risk factors added or amended in quarterly reports this reporting season, particularly related to trade policies, it is possible that there may be even lengthier risk factors in the 2026 reporting season.

Link to the full article can be found here.