What You Don’t Disclose Can Hurt You: The Power of Proactive Risk Factor Disclosures

The number of risks that public companies must contend with has always been a moving target. Add the new complex business risks we are seeing lately—including social, economic, and geopolitical changes—and you are looking at a recipe for disclosure disaster if you mindlessly stick to the old playbook.

Allow me to clarify.

The US Securities and Exchange Commission (SEC) requires US publicly traded companies to disclose, in certain reports that they file with the SEC, the material risks that might make an investment in their company’s securities (e.g., common stock) speculative or risky. Failure to adequately assess, describe, and update these risks can expose companies to regulatory enforcement and subject directors and officers to lawsuits.

This article will:

• Briefly explain the SEC’s risk factor disclosure requirements
• Explain why some public companies should consider changing their risk factor reporting strategies
• Examine how one company—Target—handled the disclosure of a sensitive and emerging risk
• Outline a few takeaways for boards and management teams to enhance their risk disclosure strategies

SEC Risk Factor Disclosure Requirements: A Quick Background

From a risk factor disclosure perspective, pre-2005 was the Wild West. An overstatement? Perhaps, but public companies weren’t required to include risk factors in their periodic reports. So those lengthy risk factor sections we are accustomed to seeing in company annual reports on Form 10-K every year were strictly voluntary.

Without specific guidance to serve as a North Star, companies fashioned their own approaches to disclosing risks. Some dedicated particular sections in their Form 10-K to discuss risks while others opted to sprinkle the discussion throughout.

In 2005, the SEC adopted new disclosure requirements requiring risk factor disclosure in Form 10-Ks, as well as updates to previously disclosed risk factors in quarterly reports on Form 10-Q. The rationale for the move was that the new disclosure requirements would promote investor protection by helping investors better assess the risks a company faces or may face in the future. Another goal was to ensure risk factor disclosures were made in a more consistent and comparable way.

If this sounds familiar, it may be because the same general rationale was given in the context of the SEC’s cyber disclosure rules.

Since 2005, the SEC has adopted amendments to modernize and streamline risk factor disclosure. The SEC has also issued guidance on how companies should consider assessing and disclosing particular risks, like those related to cybersecurity, COVID-19, and Russia’s invasion of Ukraine.

Today, the SEC, investors, and plaintiffs’ attorneys are more actively scrutinizing risk factors, especially regarding artificial intelligence, climate change, and cybersecurity. This means companies need to regularly assess whether their risk factor disclosures need to be amended to reflect any material updates.

How frequently should companies assess and update their risk factor disclosures?

The SEC’s guidance on this point has been clear. In 2005, the SEC said that companies didn’t need to restate or repeat their risk factors in their Form 10-Qs; rather, companies should update the risk factors in Form 10-Qs to reflect any material changes from previously disclosed risks. Some companies, to their detriment, may have interpreted this guidance to mean that they only need to evaluate risk factor disclosure on an annual basis in connection with their Form 10-K.

On the other hand, and despite the SEC indicating that companies didn’t need to restate or repeat their risk factors quarterly in their Form 10-Qs, many have incorporated that practice into their own disclosures. There are good reasons to consider that approach.

Quarterly Restating and Repeating Risk Factors: A Strategic Approach to Risk Mitigation

As noted above, while companies are required to update risk factors annually in Form 10-Ks, many opt to restate or repeat them quarterly in Form 10-Qs. There are a few key reasons why this approach makes sense.

Enhance a Company’s Internal Processes for Assessing and Managing Material Risks

Restating risk factors in each Form 10-Q can encourage more frequent and disciplined risk assessment across the organization. By treating risk factor disclosures as a quarterly exercise—not an annual one—companies can identify emerging threats or changing risk dynamics more promptly.

Companies that do not restate their risk factors may have a tendency to gloss over the quarterly risk assessment. They may also be reluctant to add new standalone risk factors in their Form 10-Qs, which they may feel could stick out like a sore thumb. They wouldn’t be wrong.

By restating risk factors in Form 10-Qs, companies have a good chance of avoiding these issues. The quarterly risk assessment can be more intentional, and new risk factors or modifications to existing risk factors can be incorporated into the existing content. However, the approach shouldn’t be to hide the ball when it comes to the updates. Rather, companies should denote in some way where the changes were made. No real magic here. It could be simply identifying which risk factors were updated in the lead-in to the risk factor section or noting that any changes are bolded or italicized. For additional insight on approach, see this blog from Goodwin Proctor.

Mitigate Litigation Risk

Clear and timely disclosure of material risks can serve as a critical defense in securities litigation. By restating risk factors in each 10-Q—even when risks have not materially changed—companies can signal that they are actively engaged in risk disclosure and management. The exercise itself can help identify where changes need to be made.

An example of the wrong way to handle evolving risks can be seen in how Alphabet handled disclosures concerning cybersecurity in the past. This example goes back to Alphabet’s Form 10-K that it filed in February 2018. In that filing, the company identified potential consequences of third-party breaches of its cybersecurity measures.

Fast forward to April 2018, and the company’s CEO allegedly became aware of a data breach that had exposed user data for three years. Unfortunately for Alphabet, the 10-Q filings included language that many companies that don’t restate their risk factors include. That is: “There have been no material changes to our risk factors since our Annual Report on Form 10-K for the year ended...”

When the Wall Street Journal revealed the breach in October 2018, the stock dropped, prompting securities fraud actions against the company and its executives. Shareholder plaintiffs argued that a reasonable investor would have been misled by the company’s statement in its Form 10-Qs that there were no material changes to its risk factors. Also, the company failed to disclose the data breach on related earnings calls. Plaintiffs argued that these actions suggested there were no cybersecurity issues.

It took a few years, but the lawsuit ultimately paid off for the plaintiffs’ firms to the tune of a $350 million settlement.

Provide Investors with More Transparent Risk Factor Disclosure

One of the arguments against restating risk factors in a Form 10-Q is that it makes the document unnecessarily long. I get it, but investors rely on risk factor disclosures to evaluate the true risk profile of a company. By repeating and refining risk factors in every Form 10-Q, companies enhance investor access to consistent and current risk information. This can be especially valuable during periods of economic volatility or when company-specific risks are evolving quickly. Tariffs, anyone?

Rather than assuming investors will revisit a prior 10-K or piece together risks from past filings, restating risk factor disclosure in Form 10-Qs consolidates risk information in one place each quarter. This type of transparent and frequent disclosure can help foster trust in management’s ability to identify and communicate risk. 

Besides, if there is a concern that adding more length to a Form 10-Q or more process to the filing generally isn’t desirable, re-read the section above for 350 million reasons why you may want to evaluate and restate risk factors quarterly.

Target Becomes a Target: A Case of Missing Risk Disclosures?

Target has long been recognized for its diversity, equity, and inclusion (DEI) initiatives, but the company has become a lightning rod for controversies relating to certain of those initiatives. While critics have been taking issue with several DEI initiatives, the one that is arguably the most relevant to risk factor disclosure is Target’s 2023 Pride Campaign and the customer backlash that followed.

In 2023, in the leadup to Pride Month in June, Target launched a Pride Month collection in its stores. This wasn’t anything new. It had done similar things in the past. The difference this time was related to some swimwear that was described as “tuck friendly.” Misinformation spread on social media that the swimwear was being marketed to children. It wasn’t, but the damage was done. Republican leaders and conservative media outlets made Target a topic of discussion, boycotts followed, and Target’s stock dropped $10 billion in market value in just 10 days. About $25 billion in shareholder value was erased over the course of the next six months.

As you might have guessed, securities class action lawsuits followed, one in August 2023 and another in February 2025. The general argument in the lawsuits is that Target failed to disclose known risks of customer backlash to its DEI initiatives and environmental, social, and governance (ESG) mandates. While the Form 10-K that Target filed in early 2023 included risk factor disclosure that identified ESG and DEI commitments as potentially adversely affecting the company, the lawsuits allege that Target framed these risks only in the context of negative responses from “stakeholders” to Target’s failure to achieve the ESG and DEI mandates that it adopted. That is, there wasn’t a reference to risks arising from these mandates in the first place.