The Corporate Risk Factor Disclosure Landscape   January 2016     .   The  Investor  Responsibility  Research  Center  Institute  (IRRCi)  wishes  to  thank     Ernst  &  Young  LLP,  which  was  the  primary  research  entity  for,  and  the  primary  contributor  to,   this  report.       The  copyright  for  this  report  is  held  by  the  IRRC  Institute.  The  material  in  this  report  may  be   reproduced  and  distributed  without  advance  notification,  but  only  if  attributed.  If  reproduced   substantially  or  entirely,  it  should  include  all  trademark  and  copyright  notices.     For  more  information,  please  contact:     Jon  Lukomnik,   Executive  Director   IRRC  Institute   40  Wall  Street  –  28th  Floor   New  York,  NY  10005   info@irrcinstitute.org   www.irrcinstitute.org     The  risk  factor  disclosure  landscape  |   1 .   The corporate risk factor disclosure landscape Contents Introduction..................................................................................................................................................................................... 3 Executive summary...................................................................................................................................................................... 3 Key findings ................................................................................................................................................................................. 3 Background .................................................................................................................................................................................

4 Overview of disclosures ................................................................................................................................................................ 5 Requirements............................................................................................................................................................................... 5 Disclosure by the numbers ..........................................................................................................................................................

6 Characteristics of risk factor disclosures .................................................................................................................................... 8 Risk factor categories .................................................................................................................................................................. 8 Prevalence of risk factor categories, by sector and category.....................................................................................................

12 Word search.......................................................................................................................................................................... 14 Disclosure of company-specific risk effects ............................................................................................................................... 15 Specificity in disclosure..............................................................................................................................................................

17 Disclosure of risk management efforts....................................................................................................................................... 19 Disclosure of risk factor trends................................................................................................................................................... 21 Comparison of disclosure language...........................................................................................................................................

22 Conclusion .................................................................................................................................................................................... 23 Appendix: Approach, methodology and key definitions Approach ................................................................................................................................................................................ 24 Methodology  and  key  definitions ..................................................................................................................................

25 Caveats  to  the  research   .................................................................................................................................................... 27     The  risk  factor  disclosure  landscape  |   2 .   Introduction Executive summary Risk factor disclosures provided by companies in their Form 10-K and other Securities and Exchange Commission (SEC) filings are supposed to serve an important role in the capital markets by offering investors an understanding of the risks faced by the individual companies. Instead, we find in our review of the risk factor disclosures of 50 large companies that disclosures often are generic and do not provide clear, concise and insightful information. The disclosures typically are not tailored to the specific company. Instead, they tend to represent a listing of generic risks, with little to help investors distinguish between the relative importance of each risk to the company.

In addition, the language is often repetitive and written with legal language and a compliance-oriented approach (instead of using plain English to help investors better understand and evaluate company-specific risks). Based on our study, there is an opportunity for companies to streamline language around common risk factors and to offer more insightful, company-specific information. For risks that are particularly important, a company could enhance its disclosures by providing more descriptions of its risk mitigation efforts. Companies could also consider including more company-specific detail; descriptions of how the nature, intensity and likelihood of key risks have changed or might change; and explanations of how significant risks can affect the company’s business.

Such changes could go a long way toward providing investors with more effective risk factor disclosures. Key findings 1. Companies generally are not using specific or effective language to describe their risk factors. However, in some cases certain specific language may be used, for example, if the information is already provided elsewhere in the 10-K filing. 2.

Disclosures generally are lengthy, and companies with a lower risk profile in particular have opportunities to reduce the extent and number of risk factors disclosed. 3. Competition, global market factors and regulatory matters are the most common risks cited by all companies but are often discussed generically. This suggests an opportunity for companies to reconsider existing generic discussions. 4.

When companies use specific language to discuss risk mitigation efforts and/or changes in the nature of the risk, those disclosures tend to be minimal (e.g., a couple of words or a sentence) and are overshadowed by the prevalent use of vague, boilerplate language throughout the risk factor disclosures. 5. The disclosures may serve as an indicator of what a broad base of companies view as emerging risks. Attention to nontraditional risks such as cybersecurity and climate change is evident from the review. 6.

Cybersecurity is one area where companies have responded to recent concerns expressed by investors and policymakers with disclosure that discusses the extent, effects and management of cyber risks. Furthermore, there may be significant differences between the extent and nature of cyber risk disclosures and other risk topics receiving increased focus from investors and policymakers, such as climate change. These observed differences may arise from companies' belief that cybersecurity represents a more clear and present business risk than climate change. Background The SEC staff has said that risk factor disclosures should be written better by discussing company-specific factors and focusing on how a risk would affect the company if it occurs.

As Keith Higgins, Director of the Division of Corporation Finance, has observed:     The  risk  factor  disclosure  landscape  |   3 .   “We can all probably agree that risk factors could be written better — less generic and more tailored — and they should explain how the risks would affect the company if they came to pass … [and] allow investors to zero in on the material risk …”1 The institutional investor community, too, is generally seeking more meaningful disclosure. A number of investors have observed that risk factor disclosures require attention and have made several suggestions to improve these disclosures, including:2 ! Organizing the risk factors by likelihood of occurrence or by potential magnitude ! Including a checklist for companies to identify generic risk factors but require only narrative disclosure of risks unique to the company ! Imposing a word or number limit that forces companies to focus their risk factor disclosures                                                                                                                           1  Keith Higgins, Director, Division of Corporation Finance, Disclosure Effectiveness: Remarks Before the American Bar Association Business Law Section Spring Meeting, 11 April 2014.   2      EY publication, Disclosure effectiveness: what investors, company executives and other stakeholders are saying, November 2014.   The  risk  factor  disclosure  landscape  |   4 .   Overview of disclosures Requirements SEC registrants must disclose risk factors in their annual reports, as specified in Item 503(c) of Regulation S-K,3 which instructs registrants to present risks that are specific to the company. Risk factor disclosures are recommended to be concise and organized logically in a separate subcaption that adequately describes the risk. Furthermore, Form 10-K instructions require registrants to discuss risk factors in “plain English.” Item 503(c): Where appropriate, provide under the caption “Risk Factors” a discussion of the most significant factors that make the offering speculative or risky. This discussion must be concise and organized logically.

Do not present risks that could apply to any issuer or any offering. Explain how the risk affects the issuer or the securities being offered. Set forth each risk factor under a subcaption that adequately describes the risk.

The risk factor discussion must immediately follow the summary section. If you do not include a summary section, the risk factor section must immediately follow the cover page of the prospectus or the pricing information section that immediately follows the cover page. Pricing information means price and price-related information that you may omit from the prospectus in an effective registration statement based on §230.430A (a) of this chapter.

The risk factors may include, among other things, the following: 1. Your lack of an operating history; 2. Your lack of profitable operations in recent periods; 3.

Your financial position; 4. Your business or proposed business; or 5. The lack of a market for your common equity securities or securities convertible into or exercisable for common equity securities.                                                                                                                           3      See  https://www.sec.gov/about/forms/form10-­â€k.pdf.  Smaller  reporting  companies  are  not  required  to  provide  this  information.   The  risk  factor  disclosure  landscape  |   5 .

  Disclosure by the numbers Risk factor disclosure not an insignificant portion of the Form 10-K Risk factors represent 7% of the average length of a 10-K filing by page count. On a company basis, this proportion ranges from 1% to more than 30%. On a sector basis, the proportion ranges from 4% for many sectors up to 11% to 12% for Technology, Telecommunications and Utilities. Around two-thirds of the average 10-K comprises the management discussion and analysis (MD&A) and financial statements sections.4 The remainder largely comprises the risk factor and business description sections. Form 10-K section All firms Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 1: Page count comparisons of 10-K sections by average length Risk factors 7% 7% 7% 4% 4% 8% 4% 4% 11% 12% 11% Business description 11% 12% 8% 11% 8% 14% 6% 8% 10% 19% 14% Management discussion and analysis 24% 24% 27% 21% 36% 21% 26% 24% 23% 29% 14% Financial statements 45% 45% 40% 48% 48% 47% 51% 53% 47% 23% 46% Total 87% 87% 82% 83% 97% 90% 88% 89% 92% 83% 85% Data: Average is of all companies and of companies in each sector.                                                                                                                           4  Page  count  for  10-­â€K  includes  MD&A  and  financial  statements  and  schedules  that  are  attached  as  exhibits  or  incorporated  by  reference  from  an  annual  report;   page  count  excludes  other  exhibits.  Page  count  for  financial  statements  includes  notes.  All  numbers  rounded.             The  risk  factor  disclosure  landscape  |   6 .   There is wide variation in the length and number of risk factors Risk factor sections average eight pages in length and may range from a couple of pages to more than 20 for individual companies. On a sector basis, average page length ranges from five to more than a dozen. Companies may identify a handful to 50 or more separate risk factors. On a sector basis, the average number of risk factors per sector ranges from 15 (Industrials) to 35 (Utilities). On a per-company basis, word counts range from less than 1,000 to over 15,000.5 Average word count per risk factor is less than 300. On a sector basis, average word count per sector varies from around 3,500 (Materials) to 10,500 (Financial Services). Averages All firms Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 2: Numbers around risk factor disclosure Number of risk factors 22 16 21 16 19 27 15 16 26 31 35 Total word count of risk factor section 6,210 4,312 5,423 2,981 10,519 8,070 3,704 3,458 7,456 6,494 9,678 Word count per risk factor 281 273 261 184 548 301 250 222 287 211 280 Page count of risk factor section 8 5 8 5 11 10 5 5 10 10 13 Data: Average is of all companies and of companies in each sector.

Numbers rounded.                                                                                                                           5  Risk factor word count includes subheading or subtitle for each individual risk factor. Total excludes introductory language that may be part of some risk factor disclosures, such as forward-looking safe harbor language.       The  risk  factor  disclosure  landscape  |   7 .   Characteristics of risk factor disclosures Risk factor categories Some themes emerge when a company’s individual risk factors are assigned to one of 17 risk factor categories (Figure 3 and Figure 4). Certain risk factor categories appear to be standard, defined as cases where 70% or more of all companies have a risk factor in a particular category. These categories include: capital markets and economic conditions (90%), competitive landscape (74%), corporate finance and operations (92%), corporate growth strategy (76%), cyber, physical assets and data security (78%), government and regulation (90%), and litigation and legal liabilities (72%). ! The seeming universality of these risk factor categories raises the question of to what extent the risk disclosure language is company-specific (see pages 15 to 23 for a discussion of the different types of disclosure language reviewed). ! While most of these risk factor categories represent topics that have been included in corporate risk factor disclosures for years, the focus on cyber, physical assets and data security as a primary risk topic may represent an emerging trend in the disclosure landscape due to heightened sensitivity about this topic in recent years. ! Some risk factor categories are less common — defined as cases where 30% or less of all companies have a risk factor in a particular category. These include: key personnel (28%), power and communications infrastructure (22%), company reputation (18%) and governance matters (16%). ! Company reputation appears to be a common risk factor for consumer-facing sectors such as Consumer Staples, Financial Services, Technology and Utilities. ! Risk factor disclosures focused on key personnel appear present in all sectors, with the exception of Health Care and Industrials. Risk factor disclosures around key personnel typically discuss the importance of certain executives to the company’s growth strategy, operations, culture and/or more generally, the company’s success.     The  risk  factor  disclosure  landscape  |   8 .

  Figure 3: Risk factor categories Outline of company-identified risk factors for each risk category Capital markets and economic conditions ─ Currency fluctuation and devaluation, debt and equity markets, credit risks, interest rate risk, macro and regional economy (including housing markets), inflation, employment and consumer spending, effects of monetary and fiscal policies Company reputation ─ Public perception of company, questions over ethical nature of company business or actions, controversies which may tarnish company image, such as headline-making news on supply chain Competitive landscape ─ Competitors (traditional and new/emerging) and competing products and services, including from counterfeiters Consumer power ─ Consumer preferences, demographics, regulatory changes and other drivers affecting customer demands, such as health and safety considerations, customer concentration level and related company vulnerabilities Corporate finance and operations ─ Revenue forecasts and other estimates and assumptions, short- and long-term investments, hedging, profit margins, performance and operating and financial results, goodwill, impairments, working capital management, internal controls, pension and health care costs, product and service quality, contracts and counterparty risk, insurance, inventory, property, plant and equipment Corporate growth strategies ─ Strategies such as global expansion efforts, merger and acquisition and divestiture activity, joint ventures and strategic alliances Cyber, physical assets and data security ─ Physical or electronic break-ins, data breaches, misappropriation of sensitive information, related human error and malfeasance, electronic fraud Energy and natural resources ─ Pricing of fuel, energy and commodities, access to water and other natural resources Governance matters ─ Dual-class stock structure, anti-takeover mechanisms Government and regulation ─ Taxes and import/export duties, legislation and regulatory requirements, compliance requirements, financial reporting, accounting rules, political instability, nationalization of companies/industries Human capital ─ Access to qualified labor, satisfactory relations with labor unions, retention, worker health and safety Innovation and competitiveness ─ Research and development, intellectual property rights and protections, transition process for new products and services and related technology, adjustments to effects of technological change on company business model, product and service offerings and the scale of investment needed to maintain competitiveness Key personnel ─ Continued service and availability of key individuals shaping company strategy, succession planning Litigation and legal liabilities ─ Litigation, including potential and ongoing claims, legal compliance matters, related liabilities Natural and human disruptions ─ Natural disasters, severe weather events, climate change, earthquakes, fires, war, terrorism, health pandemics and other public health crises, pollution Power and communications infrastructure ─ System failures, network disruptions, communications lines and capacity, power shortages Supply chain and third party ─ Sourcing, production, distribution and related logistical services, performance of vendors and distributors, access to and availability of third-party intellectual property, content and support     The  risk  factor  disclosure  landscape  |   9 .   The sector perspective provides some interesting insights. For example, supply chain and third-party matters do not appear to represent a primary risk for Energy, Materials and Financial Services companies. Another example is the innovation and competitiveness category appears to be less of a focus for companies in the Energy, Financial Services, Industrials and Utilities sectors (compared to, say, the Materials and Telecommunications sectors). A comparison of the sectors also shows that Energy companies appear to differ from others. For most of the 17 categories, the portion of Energy companies providing similar disclosures tends to be lower than other sectors. Similarities among companies in a particular sector may be due, in part, to the decision by some companies to draft their risk factor disclosures with an eye to the disclosures provided by peers.

Such benchmarking may result in similar disclosures among companies with comparable business models and risk exposures, thereby decreasing corporate-specific risk disclosure.     The  risk  factor  disclosure  landscape  |   10 .   Risk factor category All firms Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 4: Portion of companies (in total and by sector) disclosing a risk factor in each category Capital markets and economic conditions 90% 100% 100% 40% 100% 80% 100% 100% 80% 100% 100% Company reputation 18% 0% 60% 0% 60% 0% 0% 0% 20% 0% 40% Competitive landscape 74% 80% 100% 20% 60% 100% 60% 80% 100% 100% 40% Consumer power 62% 80% 100% 20% 0% 80% 80% 60% 60% 40% 100% Corporate finance and operations 92% 80% 80% 80% 100% 100% 80% 100% 100% 100% 100% Corporate growth strategy 76% 80% 100% 40% 40% 80% 80% 100% 100% 80% 60% Cyber, physical assets and data security 78% 80% 100% 20% 80% 80% 80% 80% 100% 80% 80% Governance matters 16% 20% 0% 0% 0% 0% 20% 20% 40% 60% 0% Government and regulation 90% 100% 100% 100% 100% 100% 60% 100% 100% 100% 100% Human capital 52% 60% 80% 40% 80% 20% 40% 20% 40% 60% 80% Power and communications infrastructure 22% 20% 20% 0% 20% 0% 0% 0% 60% 60% 40% Innovation and keeping current 56% 60% 60% 40% 20% 60% 40% 80% 60% 100% 40% Key personnel 28% 40% 20% 20% 20% 0% 0% 40% 80% 60% 20% Litigation and legal liabilities 72% 40% 80% 40% 20% 100% 100% 100% 100% 80% 60% Natural and human disruptions 62% 0% 60% 80% 40% 80% 40% 40% 80% 100% 100% Energy and natural resources 42% 40% 40% 100% 0% 0% 20% 100% 0% 20% 100% Supply chain and 54% 60% 100% 0% 20% 100% 80% 0% 80% 60% 40% third party Data: Percent is of all firms and of companies in each sector that have at least one risk factor assigned to the relevant risk factor category. Prevalence of risk factor categories, by sector and category Looking at the distribution of risk factor categories — based on the total number of risk factors disclosed per sector and in total across all companies (1,100 individual risk factors across the 50 companies) — provides insights into the relative concentration of each risk factor category within each sector (Figure 6). For example:     The  risk  factor  disclosure  landscape  |   11 .   ! The three risk factor categories most common to Financial Services companies — and representing 77% of all risk factors cited — are government and regulation (30%), corporate finance and operations (27%), and capital markets and economic conditions (20%). ! The three main categories for Energy companies — and representing 67% of all risk factors cited — are government and regulation (31%), corporate finance and operations (22%), and energy and natural resources (14%). ! Consumer Staples shows a wider dispersion of risk factors with four risk factor categories comprising 49% of risk factors cited: government and regulation (16%), capital markets and economic conditions (13%), consumer power (10%), and corporate finance and operations (10%). Focusing on risk factor categories, we find that while no industry sector accounts for more than one-third of the total risk factors cited for any risk factor category, certain industry sectors represent a relatively high proportion of the risk factors cited in some categories (Figure 5). Figure 5: Sector(s) accounting for most of the risk factors in select categories Company reputation – Consumer Staples, Financial Services 33% Energy and natural resources – Energy 33% Governance – Technology 33% Power and communications infrastructure – Technology 31% Competitive landscape – Health Care 29% Key personnel – Technology 29% Consumer power – Industrials 28% 25%   27%   29%   31%   33%   35%       Utilities Telecommunications Technology Materials Industrials Health Care Financial Services Energy Consumer Staples Consumer Discretionary Risk factor category All firms Figure 6: Distribution/frequency of risk factor disclosure based on total number of risk factors The  risk  factor  disclosure  landscape  |   12 .   Capital markets and economic conditions 11% 11% 13% 8% 20% 8% 15% 13% 6% 9% 12% Company reputation 1% 0% 3% 0% 3% 0% 0% 0% 1% 0% 1% Competitive landscape 5% 5% 6% 1% 3% 12% 4% 5% 5% 6% 1% Consumer power 5% 8% 10% 1% 0% 7% 22% 4% 3% 1% 4% Corporate finance and operations 22% 18% 10% 22% 27% 21% 12% 21% 22% 31% 25% Corporate growth strategy 7% 9% 8% 4% 2% 4% 5% 6% 9% 10% 10% Cyber, physical assets and data security 4% 8% 5% 1% 4% 3% 7% 5% 6% 3% 3% Governance matters 1% 1% 0% 0% 0% 0% 3% 4% 4% 3% 0% Government and regulation 18% 11% 16% 31% 30% 19% 8% 19% 13% 12% 23% Human capital 3% 4% 4% 3% 4% 1% 4% 1% 2% 3% 3% Power and communications infrastructure 1% 1% 2% 0% 1% 0% 0% 0% 3% 2% 1% Innovation and keeping current 4% 6% 4% 4% 1% 6% 4% 5% 5% 6% 1% Key personnel 1% 3% 1% 1% 1% 0% 0% 3% 3% 2% 1% Litigation and legal liabilities 5% 4% 5% 4% 1% 7% 7% 8% 9% 5% 3% Natural and human disruptions 4% 0% 5% 6% 2% 4% 5% 3% 3% 3% 7% Energy and natural resources 3% 3% 4% 14% 0% 0% 1% 8% 0% 1% 5% Supply chain and third party 4% 9% 7% 0% 1% 9% 5% 0% 8% 4% 1% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% Total Data: Frequency calculated as a percent of the total number of risk factors for all firms and for each sector based on a review of 1,100 risk factor disclosures across 50 companies. Numbers rounded.     The  risk  factor  disclosure  landscape  |   13 .   Word search Policymakers, investors and companies are paying more attention to the quality of company disclosures at a time when there is growing focus on hot button topics such as reputational risk, climate change and cybersecurity. Considering that the risk category approach can obscure subtler themes in the disclosure, a word search approach was applied to gain greater visibility into these themes. We tracked the number of companies that used these words — or closely related language (for example, information security in addition to cybersecurity) and found that: ! References to cybersecurity and reputational risk were prevalent, but not discussed by all companies. ! Less than two-thirds of companies made some reference to severe weather events or natural disasters (hurricanes, drought, flooding): 62% of companies discussed natural and human disruptions as a primary risk. Within the natural and human disruptions category, a little over half (54%) specifically referred to climate change as a risk issue. Note: The use of these words may be in connection with broader developments (such as expected regulations and/or legislation related to climate change) and may not necessarily reflect a company’s level of attention or views on the specific topic. Words/ topics searched All firms Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 7: Disclosures including use of specific word or topic Company reputation, reputational risk 84% 100% 100% 40% 80% 80% 80% 100% 100% 80% 80% Climate change, changes in climate 54% 40% 80% 100% 40% 40% 40% 60% 60% 20% 80% Cyber, information security 96% 100% 100% 80% 100% 80% 100% 100% 100% 100% 100% Data: Percentage is of all companies and for all companies in each sector. Disclosure of company-specific risk effects     The  risk  factor  disclosure  landscape  |   14 .   To get a sense of the extent to which a risk factor may reflect company-specific risks (beyond common, boilerplate language), each company’s individual risk factors are assigned to as many as four categories based on the type of disclosure language: effect of the risk on the company, the level of specificity, how the company manages or mitigates risk, and changes in the intensity, nature or likelihood of the risk.6 Of these four categories, the most common approach is disclosure of the effect of the risk on a company (Figure 8). However, these disclosures are typically vague. For example, risk effects are often simply described as affecting demand, competition, profitability and/or company liabilities. Examples of topic areas (not risk factor categories) where companies may provide more specific language about the effect of the risk on a company include: ! Competition and consumer demand: Where intellectual property rights are a competitive advantage (and necessity), a loss of sales in connection with expired patents and the ready availability of comparable or generic products. Also where governmental organizations are a significant direct or indirect consumer, the company may be challenged by a limitations on its ability to price, sell and otherwise distribute products — with related effects on revenue, cash flows, profitability and production pipeline. ! Financial and operational effects: Slowing a company’s ability to introduce new products; forcing costs to be passed on to customers; raising a company’s cost of funds, including margin requirements; requiring increased allowances for losses, as well as impairments and write-offs; challenging a company’s effort to exit a business in a timely manner and on optimal terms; and increasing the amount of required cash contributions to pension plans. ! Regulatory and legal effects: Requiring a company to respond to intellectual property challenges regardless of merit of such claims, increasing a company’s effective tax rate, and direct (prohibitions, quotas) and indirect (taxes, duties) limitations on a company’s ability to sell products. Categories where companies are less likely to identify the risk effect include capital markets and economic conditions, key personnel and litigation. When the company does not explain the effect of a potential risk on the company, most of the risk factor’s disclosure focuses instead on explaining or defining the risk.                                                                                                                           6 Specificity is defined as references to amounts (numbers, percentages, proportions) such as with regard to customers, suppliers and employees; use of proper names (such as regarding key personnel, products and project families, operating units, markets); and company-specific developments (operational improvement programs, restructuring efforts, named legislation and laws affecting the company).       The  risk  factor  disclosure  landscape  |   15 .

  Risk factor category Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 8: Disclosure of risk effect on company Capital markets and economic conditions 89% 100% 100% 100% 73% 91% 90% 100% 100% 100% Company reputation 0% 100% 0% 100% 0% 0% 0% 100% 0% 50% Competitive landscape 100% 100% 100% 100% 69% 100% 75% 100% 67% 100% Consumer power 100% 100% 100% 0% 44% 94% 100% 100% 100% 100% Corporate finance and operations 100% 80% 76% 100% 57% 89% 100% 93% 83% 98% Corporate growth strategy 100% 100% 100% 100% 40% 75% 100% 100% 88% 82% Cyber, physical assets and data security 100% 100% 100% 100% 75% 100% 100% 100% 100% 100% Governance matters 100% 0% 0% 0% 0% 0% 0% 20% 100% 0% Government and regulation 100% 94% 83% 100% 56% 100% 100% 100% 68% 100% Human capital 100% 75% 100% 100% 0% 100% 0% 100% 75% 100% Power and communications infrastructure 100% 100% 0% 0% 0% 0% 0% 100% 67% 100% Innovation and keeping current 100% 100% 67% 100% 50% 100% 100% 100% 67% 100% Key personnel 50% 100% 100% 0% 0% 0% 50% 75% 33% 0% Litigation and legal liabilities 100% 100% 100% 100% 60% 100% 67% 100% 86% 100% Natural and human disruptions 0% 100% 80% 100% 40% 75% 100% 100% 80% 100% Energy and natural resources 100% 100% 91% 0% 0% 100% 100% 0% 100% 100% Supply chain and third 100% 100% 0% 100% 50% 100% 0% 100% 100% party Data: Percentage of total risk factors per category and sector; based on a review of 1,100 risk factor disclosures across 50 companies.     100% The  risk  factor  disclosure  landscape  |   16 .   Specificity in disclosure Disclosure language is often vague and the use and extent of detail vary (Figure 9). Examples of specificity in disclosure include: ! Naming competitors or naming key employees ! Specific recent or upcoming events, regulatory changes and actions by government agencies that may affect company operations and profitability, domestically or abroad, such as via industrial policies, import quotas and taxes ! Product families and operational units with unique risks that are public, such as key patents that are close to expiration or offices and plants located in earthquake zones ! Information about certain corporate finance or operational matters that is discussed elsewhere in the Form 10-K or is otherwise publicly available, such as merger, acquisition and divestiture events; debt and interest exposures; credit ratings; the number of countries where a company does business; and the number of employees. ! Litigation events, regulatory investigations and other headline news affecting the company’s growth prospects and/or certain markets where a company may have significant exposure (e.g., currency devaluation, civil unrest). Additional disclosures come through on a sector basis; for example: ! Energy — Disclosures commonly include information on research into alternative energy sources, upcoming climate change related legislation that may materially affect the company, and reserve data. ! Financial Services — Some companies provide information on current credit ratings, debt levels and credit exposures. ! Health Care — Details may include the discussion of specific products (such as patent expiration dates), product families and the effects of regulatory decisions on the business. Four sectors generally provide more examples of specificity in risk factor disclosures: Consumer Staples, Financial Services, Health Care and Technology.     The  risk  factor  disclosure  landscape  |   17 .   Risk factor category Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 9: Frequency of specific risk disclosure Capital markets and economic conditions 0% 46% 50% 37% 36% 64% 40% 38% 21% 10% Company reputation 0% 33% 0% 33% 0% 0% 0% 0% 0% 0% Competitive landscape 50% 83% 0% 0% 44% 0% 25% 71% 0% 0% Consumer power 17% 30% 0% 0% 67% 63% 0% 0% 50% 14% Corporate finance and operations 36% 30% 24% 54% 39% 56% 44% 41% 44% 26% Corporate growth strategy 14% 38% 0% 50% 60% 50% 20% 42% 31% 29% Cyber, physical assets and data security 17% 20% 0% 25% 0% 20% 0% 25% 0% 0% Governance matters 100% 0% 0% 0% 0% 0% 0% 40% 50% 0% Government and regulation 56% 47% 29% 52% 48% 17% 47% 53% 42% 33% Human capital 33% 0% 0% 25% 0% 67% 100% 50% 75% 20% Power and communications infrastructure 0% 50% 0% 0% 0% 0% 0% 25% 0% 0% Innovation and keeping current 40% 0% 0% 0% 50% 33% 25% 33% 0% 50% Key personnel 50% 100% 100% 100% 0% 0% 0% 75% 0% 0% Litigation and legal liabilities 33% 40% 33% 0% 70% 20% 33% 17% 14% 50% Natural and human disruptions 0% 40% 0% 0% 60% 0% 50% 75% 20% 33% Energy and natural resources 0% 75% 18% 0% 0% 0% 33% 0% 0% 13% Supply chain and third party 14% 14% 0% 100% 50% 25% 0% 50% 33% 50% Data: Percentage of total risk factors per category and sector; based on a review of 1,100 risk factor disclosures across 50 companies.     The  risk  factor  disclosure  landscape  |   18 .   Disclosure of risk management efforts Risk mitigation language tends to appear most often in connection with certain types of risk. While a number of companies provide limited disclosure about risk mitigation (“Company X has processes/policies/limits in place to address …”) — and disclosure is limited to a couple of words or sentences — others offer more extensive disclosures. High-profile risks, such as cybersecurity, are where mitigation language is most common (Figure 10). Examples of more concrete language used to describe risk mitigation efforts on cyber risks include references to the use of passwords, user names, encryption and authentication technology; maintenance of back-up systems and business continuity plans; and the monitoring of networks and systems, including those of third-party providers. Risk management language is also often found in areas where risk mitigation tools appear readily available. Examples of these topic areas (not risk factor categories) and some of the tools used include: ! Competitive matters — Investing in research and development, and protecting intellectual property rights (patents, copyrights, trademarks, information technology security, litigation, confidentiality and license agreements with employees and other parties) ! Financial and operational — Obtaining appropriate insurance coverage, maintaining liquidity and borrowing capacities to satisfy short-term obligations if needed, and regularly evaluating accruals and allowances ! Foreign currency and interest rate fluctuations, and swings in energy and commodity prices — Using derivatives contracts and other hedging tools, constructing supply and delivery contracts with matching time frames or that transfer price risk to the customer, diversification (markets, customers and suppliers) ! Fraud and other employee (and supplier) compliance risks — Implementing policies, controls and procedures to support employee and supplier compliance, and implementing a review of existing compliance systems (including across markets) Less common areas for risk mitigation language include those below.

The infrequency with which the language is found suggests that the language reflects company-specific disclosure. Yet, the language may still be vague. That said, while these risk mitigation disclosures are less common, some of the related risks may not be. ! Company reputation — Investing in corporate responsibility efforts, focusing marketing and branding efforts to enhance brand loyalty, and using cross-selling to enhance company appeal ! Competitive — Exploring the creation or sourcing of alternative products and/or components (such as energy companies investing in the research of alternative fuels), and creating different menu and pricing options and promotional activities ! Counterparty risk — Monitoring the financial condition of customers, suppliers and distributors ! Key personnel – Maintaining long- and short-term succession plans, and structuring equity compensation to encourage and reward retention. Figure 10: Disclosure of risk management/mitigation efforts     The  risk  factor  disclosure  landscape  |   19 .

Risk factor category Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities   Capital markets and economic conditions 11% 15% 0% 21% 18% 36% 30% 38% 0% 20% Company reputation 0% 33% 0% 33% 0% 0% 0% 0% 0% 0% Competitive landscape 25% 17% 0% 0% 6% 33% 25% 43% 11% 0% Consumer power 17% 10% 0% 0% 11% 25% 67% 25% 0% 14% Corporate finance and operations 14% 10% 29% 35% 7% 33% 38% 17% 4% 21% Corporate growth strategy 0% 13% 33% 50% 0% 25% 20% 0% 13% 6% Cyber, physical assets and data security 50% 60% 100% 100% 50% 80% 100% 63% 50% 80% Governance matters 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% Government and regulation 0% 18% 29% 7% 4% 0% 20% 41% 11% 5% Human capital 0% 25% 0% 75% 0% 0% 0% 0% 0% 0% Power and communications infrastructure 0% 50% 0% 0% 0% 0% 0% 25% 67% 0% Innovation and keeping current 40% 50% 0% 0% 63% 100% 100% 50% 11% 0% Key personnel 50% 0% 0% 100% 0% 0% 0% 50% 0% 0% Litigation and legal liabilities 33% 0% 33% 0% 40% 40% 50% 33% 0% 0% Natural and human disruptions 0% 20% 40% 50% 20% 25% 0% 25% 40% 17% Energy and natural resources 0% 25% 0% 0% 0% 100% 67% 0% 0% 13% Supply chain and third party 29% 43% 0% 100% 8% 25% 0% 30% 0% 0% Data: Percentage of total risk factors per category and sector; based on a review of 1,100 risk factor disclosures across 50 companies.     The  risk  factor  disclosure  landscape  |   20 .   Disclosure of risk factor trends Disclosures about how a risk factor may change in nature, intensity or likelihood, may provide insights into how a particular risk factor may affect a company (Figure 11). Some trends appear to be common across companies. These include discussion of the following: ! Significant changes in the technological landscape affecting established business models — and an increased likelihood of cyber attacks, which are also becoming more sophisticated ! The growing diversity and intensity of competition in connection with global and technological developments ! An increasingly challenging regulatory environment with greater regulatory scrutiny and complexity, significant changes expected with regard to tax policies, and expectations of new requirements, such as in connection with the Dodd-Frank Wall Street Reform and Consumer Protection Act, the Patient Protection and Affordable Care Act, and efforts to reduce greenhouse gas emissions ! Rise in operational costs, such as with regard to employees (medical benefits, pensions) ! An increased amount of litigation A review of disclosures by sector shows certain industry-specific trends; for example: ! Health Care companies are observing the changes in the competitive landscape related to generics and other competing products, pricing pressures and access or distribution restrictions, changes in purchasing patterns, and growing challenges in getting adequate, cost-effective product liability insurance. ! Financial Services companies are discussing recent and potential developments affecting their business prospects, such as regulatory developments (e.g., the Third Basel Accord, Volcker Rule), instability and credit deterioration in the marketplace, changes in how the London InterBank Offered Rate (LIBOR) is calculated and how credit rating companies are evaluating risks. Some sectors tended to provide more disclosure around trends. Financials, Telecommunications, Consumer Discretionary, and Health Care, for example, discuss changes related to government and regulation, as well as the broader competitive landscape. In comparison, Energy and Utilities companies generally provided little in the way of trend information outside of customer efforts to enhance energy efficiency.     The  risk  factor  disclosure  landscape  |   21 .   Risk factor category Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 11: Disclosure of trend information Capital markets and economic conditions 33% 0% 0% 47% 27% 0% 10% 0% 7% 0% Company reputation 0% 33% 0% 100% 0% 0% 0% 0% 0% 0% Competitive landscape 50% 0% 0% 67% 44% 33% 25% 43% 44% 0% Consumer power 33% 0% 0% 0% 22% 13% 33% 75% 50% 29% Corporate finance and operations 7% 10% 0% 23% 18% 0% 19% 7% 13% 7% Corporate growth strategy 0% 0% 0% 100% 20% 0% 0% 0% 0% 0% Cyber, physical assets and data security 33% 0% 0% 100% 50% 40% 0% 63% 0% 0% Governance matters 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% Government and regulation 56% 35% 25% 48% 40% 33% 27% 29% 37% 25% Human capital 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% Power and communications infrastructure 0% 0% 0% 0% 0% 0% 0% 25% 33% 0% Innovation and keeping current 60% 0% 0% 0% 0% 0% 0% 0% 11% 0% Key personnel 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% Litigation and legal liabilities 0% 20% 0% 100% 30% 0% 17% 33% 14% 0% Natural and human disruptions 0% 0% 0% 0% 20% 0% 0% 25% 0% 0% Energy and natural resources 0% 0% 18% 0% 0% 0% 50% 0% 100% 25% Supply chain and third party 0% 0% 0% 0% 25% 0% 0% 10% 17% 0% Data: Percentage of total risk factors per category and sector; based on a review of 1,100 risk factor disclosures across 50 companies. Comparison of disclosure language The summary table below shows a comparison of how the use of disclosure language varies. Note that in general, most disclosure comprises general language that is common across companies. The data points below reflect cases where the particular type of disclosure was found based on the total number of risk factors for all firms and for companies in each sector. Moreover, most of the disclosure language tends to be high level and general.     The  risk  factor  disclosure  landscape  |   22 .

  Disclosure language All firms Consumer Discretionary Consumer Staples Energy Financial Services Health Care Industrials Materials Technology Telecommunications Utilities Figure 12: Disclosures on the nature of the risk (i.e., beyond simple definition of risk) Effect on company 91% 97% 96% 86% 99% 78% 93% 92% 97% 82% 97% Specificity 35% 28% 38% 22% 44% 47% 41% 35% 41% 29% 24% Risk mitigation 20% 18% 19% 22% 27% 16% 31% 37% 29% 8% 11% Trend information 19% 24% 11% 9% 43% 28% 9% 18% 20% 15% 10% Data: Percentage is of total risk factors for all firms and each sector based on a review of 1,100 risk factor disclosures across 50 companies. Conclusion There is an opportunity for companies to streamline language around common risk factors. More importantly, there is an opportunity for companies to offer more insightful, company-specific information. For those risks that are particularly important, a company could enhance its disclosures by providing more descriptions of its risk mitigation efforts. Additional approaches that a company could take might include the greater use of company-specific detail; descriptions of how the nature, intensity and likelihood of key risks have changed or might change; and explanations of how significant risks can affect the company’s business.

Such changes could go a long way toward providing investors with more effective risk factor disclosures.     The  risk  factor  disclosure  landscape  |   23 .   Appendix: Approach, methodology and key definitions Approach This report provides an overview of the current disclosure landscape based on a review of risk factor disclosures (from Item 1.A) in Form 10-K filings.7 The data set comprises the 50 companies which are the five largest US companies by market capitalization across all 10 industry sectors; these companies represented approximately $8 trillion in market capitalization as of January 2015.8 The analysis focused on the types of risk discussed and the language used in the companies’ self-identified risk factors. Companies were reviewed individually, together as a group, and on a sector basis for similarities in their approach to disclosure. While the data set is limited and results may have varying levels of applicability to a broader population of companies, the research is intended to help inform companies, investors, regulators and others on the current state of risk disclosures at the largest US companies. Large companies are generally known for having more corporate reporting resources and more rigorous disclosure practices (compared to small and mid-sized companies). Large companies are also more likely to use “plain English” to communicate this information to a broad audience of investors. In addition, they are more likely to be exposed to more types of risk, given their more diversified, complex and global operations. Exposure to this wide range of risks means that large companies can provide insights into additional risk factors. For this study, we considered and evaluated several aspects of risk factor disclosures to assess whether there are opportunities for improvement.

The following summarizes our approach to analyzing each area: 1. Types of risk factor categories — We assigned each company’s risk factor disclosures to one of 17 categories (Figure 3). The most common categories across companies and industries often included generic risk topics, such as economic conditions, competition and regulatory factors.

Although there were varying levels of company-specific discussion, these risk factor areas likely reflect the best opportunities for companies to streamline disclosures. We also observed that cybersecurity disclosures have become prevalent in company filings (78% of companies sampled include a risk factor that is primarily focused on cyber or information security risks). This trend is not surprising given the recent increase in the frequency and severity of cyber attacks and the significant public attention and concern afforded the topic.

Looking at another emerging risk area, we noted that 62% of companies broadly discussed natural and human disruptions as a key risk factor – and a little over half (54%) specifically referred to climate change. 2. Disclosure language – We measured certain attributes of language used to discuss risk factors, including how a risk affects the company, how the company manages or mitigates the risk, how likely the risk is or how the risk has changed. In addition, we analyzed specificity in the disclosure language by considering the use of numbers and percentages, references to specific operating units, markets, products, customers or specific individuals.

These attributes do not necessarily measure how effective a company’s disclosure is, particularly because these attributes may represent only a small fraction of the disclosure about the risk factor, which otherwise could be generic or boilerplate. However, these attributes are consistent with recent suggestions by the SEC staff and investors to enhance risk disclosures. Therefore, we considered the risk factor categories where companies most often provided this type of language.                                                                                                                           7  In focusing on Item 1.A, the analysis excludes a review of risk disclosures that are included elsewhere in the Form 10-K filing, such as market risk disclosures required by Item 305 of Regulation S-K or other risk disclosures in the business section.

However, a company may cross-reference other sections of the 10-K, such as Item 7.A (management discussion and analysis) as part of its risk factor disclosures. Disclosure language is from the most recent Form 10-K filing as of 20 January 2015. 8 Industry definitions are based on the two-digit Global Industry Classification Standard and include: consumer discretionary, consumer staples, energy, financial services, health care, industrials, materials, technology, telecommunication and utilities.     The  risk  factor  disclosure  landscape  |   24 .   Methodology and key definitions To adjust for company-specific variations in how risk factors are discussed, risk factor data was normalized by assigning each company’s specific risk factors to one of 17 risk factor categories (Figure 3). These categories were developed based on commonly cited risk factors, such as “government and regulation.”9 In some cases where a risk factor appeared to cross multiple categories, the category designation was based on the primary risk discussed. For example, in a discussion of possible natural and human disruptions, a company might include a minor reference to cybersecurity as an example of one of many possible human disruptions. In this situation, the risk factor was assigned to the natural and human disruptions category (versus cyber, physical assets and data security).10 To supplement this approach, we also performed a word search to capture minor risk factor references (see page 14). To track the extent to which a risk factor may reflect company-specific risks (beyond common, boilerplate language), each company’s individual risk factors were further assigned to additional categories as relevant based on the type of language used (see below).

For example, one company might discuss the effect of price volatility of raw materials, state that some or all of these risks are hedged, discuss trends in supply and demand for certain supplies, and reference the specific operating units and/or markets that are particularly affected by these trends. That description would then qualify the disclosure for each of the four types of disclosure language reviewed: potential effect of the risk to the company, risk mitigation, changes in the nature of the risk, and specificity. Each of the four types of disclosure language is defined as follows: ! Forward looking language assessing the potential effect of the risk to the company — One example is a discussion of how expected changes in domestic and global tax policies may affect profitability and/or corporate expansion plans. For this category, we did not include the use of general language, such as “X may affect the company” or “X may adversely affect the company.” ! References to company efforts to manage or mitigate the risk — Examples include hedging to offset currency and interest rate fluctuations, company strategies to address cybersecurity, and policies, practices and training to mitigate employee compliance-related risks. ! Language describing risk-related trends and developments — Includes changes in the likelihood, nature or severity of the risk affecting the company, such as changes in the global competitive landscape, trends in resource scarcity and technological changes that affect a company’s business model. ! Level of specificity (detail) provided in the risk factor disclosure — Examples may include the use of numbers and percentages such as with regard to customers, suppliers and employees, as well as references to operating units, markets, products, specific individuals, and company-specific developments such as operational improvement programs and restructuring efforts. The categorized risk factor disclosures were then reviewed for the following:                                                                                                                           9  Subheadings and subtitles were used to define specific risk factors in the Item 1.A section.

Initially, more than 20 separate risk factor categories were considered in order to provide a more detailed approach. Over the course of the research, certain categories were combined due to the frequency of overlapping risk factor language. Examples of such combinations include capital markets and economic conditions, corporate finance and operations, and litigation and legal liabilities.   10  Use of this approach potentially lends a bias to results by implying some topics were “not discussed” in the disclosure when they may have been referenced, even if only briefly.

For example, coverage of a topic through use of a word search may pick up references to risks not necessarily reflected at the bucket level.     The  risk  factor  disclosure  landscape  |   25 .   ! Types of risk factors were disclosed — Based on the portion of all firms and companies in each sector that disclosed at least one risk factor in each of the 17 risk factor categories. ! Distribution of risk factors by category — Calculated as the number of risk factors in each risk category as a percent of total risk factors for all 50 firms and for all companies in each sector: o Sector analysis (where the total number of risk factors in a sector was set to 100%) was used to draw out which risk factor categories accounted for most of a sector’s risk disclosures. o Risk factor category analysis (where the total number of risk factors of the 50 company universe was set to 100%) was used to see which sectors accounted for a significant amount of the disclosures in each category. ! Disclosure language associated with each risk category — The portion of risk factors for all 50 companies and the five companies in each sector that included one or more of the following types of disclosure language –company effect, risk mitigation, trend information, specificity –for each of the 17 categories. For example, in the Consumer Discretionary sector, over half (56%) of the risk factors assigned to the government and regulation category included specificity in the disclosure language. In comparison, the figure for Industrials was 17%. To capture a snapshot of the companies’ broader approach to disclosure, we also used quantitative data (e.g., word counts and page counts) from Form 10-K filings to estimate the relative level of attention to risk factors.11                                                                                                                           11  Word counts are based on the built-in counter in Microsoft Word. Page counts are used for a broader look at the 10-K and are based on numbers provided in the table of contents without regard to amount of content.       The  risk  factor  disclosure  landscape  |   26 .

  Caveats to the research The data set is limited and results may have limited applicability to a broader population of companies. The reviewed disclosure language is limited to Item 1.A in the 10-K regulatory filing. Companies may provide additional disclosures about their risks, such as in sustainability reporting, press releases and other sections of the 10-K (such as Item 7.A or the management discussion and analysis (MD&A) section). Each company’s use of subheadings and subtitles in Item 1.A — and by extension, its individual approach to grouping selfidentified risks — served as the basis for our definition of separate, individual risk factors. Risk factors were categorized into 17 different “buckets” to both adjust for company-specific variations in how the risk factors were discussed and normalize the data. This approach potentially lends a bias to results by leading some readers to infer that some topics were “not discussed” in the disclosure when they may have been referenced, if only briefly. For example, a word search may pick up references to risks not necessarily reflected at the category level. Disclaimers: ! The general language used in disclosures may not fully reflect the relative importance of specific risk factors to individual companies.

Sector-focused analysis is based on averages for the sector and these numbers may differ from an individual underlying company. ! Length of disclosure does not necessarily correlate to quality, although some readers may infer that it does, given the study’s look at word and page counts. ! The research represents disclosures as of a single point in time, fiscal year ended 2014, and may not reflect ongoing changes in corporate disclosures following calls by policymakers and investors for more meaningful disclosure.     The  risk  factor  disclosure  landscape  |   27 .