Limited Risk Disclosure Updates Despite Political and Economic Volatility

Why It Matters

Lengthier, less targeted risk disclosures dilute investor insight and increase compliance costs, challenging the SEC’s goal of clearer, material‑focused reporting.

Key Takeaways

• 75% of S&P 500 firms didn't update quarterly risk factors
• Average disclosure length now 14.3 pages, still growing
• Trade policy dominates new risk-factor updates
• General risk heading used by one‑third of firms
• SEC urges specific, non‑boilerplate language

Pulse Analysis

The SEC’s 2020 risk‑reporting reforms intended to curb the growing volume of risk‑factor disclosures, yet Deloitte and the USC Marshall Institute’s latest five‑year study shows the opposite. Over the past year, the average S&P 500 filing expanded to 14.3 pages and 32 distinct risk factors, with more than half of the companies adding content despite guidance to streamline. This trend reflects a broader macro environment—rising geopolitical tension, volatile trade policies, and heightened sustainability scrutiny—that compels firms to disclose an ever‑wider array of potential threats.

Quarterly filings provide a critical checkpoint for material changes, but the data reveal a stark compliance gap. Only 94 companies—roughly one‑quarter of the sample—updated their risk‑factor sections after the April 2, 2025 deadline. Among those, the majority focused on trade‑policy shifts, government contracting, and sustainability reporting, underscoring where investors perceive the most immediate risk. The remaining 333 firms either asserted no material changes or omitted a dedicated risk‑factor section, raising questions about the effectiveness of the SEC’s update requirement and the consistency of risk communication across the market.

For practitioners, the findings translate into actionable priorities. Aligning external disclosures with internal ERM frameworks can streamline updates and ensure specificity, reducing reliance on boilerplate language. Leveraging a clear risk taxonomy improves heading relevance and readability, while adopting plain‑English sentence limits enhances investor comprehension. As regulatory scrutiny intensifies, firms that proactively refine their risk narratives will not only meet compliance expectations but also strengthen stakeholder confidence in an increasingly uncertain economic landscape.

Limited Risk Disclosure Updates Despite Political and Economic Volatility

Dean Kingsley, Principal, Deloitte & Touche LLP · Kristen Jaconi, Professor of the Practice in Accounting and Executive Director, Peter Arkley Institute for Risk Management, USC Marshall School of Business

The pace of change in the external risk environment has been unrelenting over the past 12 months, as U.S. companies have faced an unprecedented and highly dynamic set of external drivers impacting their businesses. These drivers have included significant political and regulatory shifts, a complex business environment combining low economic optimism and high interest rates with fairly stable economic growth and labor markets, ongoing and mutating global conflicts and other geopolitical challenges, and substantial disruptions in the global trade environment.

Deloitte and the USC Marshall School of Business Peter Arkley Institute for Risk Management have completed our fifth year of analysis of annual risk‑factor disclosures of Standard & Poor’s (S&P) 500 companies. Although the Securities and Exchange Commission (SEC) sought to reduce the volume of risk‑factor disclosures in its 2020 risk‑reporting reforms, companies have provided lengthier risk‑factor disclosures this past reporting season reflecting this complex and dynamic environment.

This year, we also conducted a review of the first quarterly reports filed after April 2, 2025 to understand whether companies chose to update their risk factors to reflect any material changes since the filings of their annual reports, an update required by SEC regulations. In fact, over 75 % of companies did not update their risk‑factor disclosures. However, 94 companies did, either restating their risk factors in their entirety or disclosing one to seven stand‑alone risk factors. As expected, many of these updated risk factors related to evolving trade policies, government funding and/or contracting, and corporate sustainability reporting.

---

Background

Deloitte and the USC Marshall Peter Arkley Institute for Risk Management published our initial risk‑factor disclosures analysis in March 2021. We concluded that risk‑factor disclosures of S&P 500 companies were becoming lengthier, contravening the SEC’s stated intention in the amended requirements. Follow‑up reports in November 2021, December 2022, and November 2023 confirmed our initial analysis and showed a continuing trend toward lengthier disclosures. Our October 2024 report showed that disclosures were stabilizing, growing minimally in page count and risk‑factor count.

In this latest report, we have reviewed the risk‑factor disclosures in the annual reports of 427 S&P 500 companies to identify trends during this fifth year of implementation. We also reviewed the first quarterly reports filed after April 2, 2025 to understand whether companies chose to update their risk factors to reflect any material changes since the filings of their annual reports. Finally, we provided some high‑level considerations for companies as they prepare for the next reporting season.

---

Analysis of Rules Adoption

To assess the adoption of the amended requirements over five years of implementation, we reviewed the risk‑factor disclosures of 427 S&P 500 companies that filed five annual reports between November 9, 2020 (the effective date of these requirements) and May 9, 2025. Key findings:

• Page count: The average number of pages is about 14.3 per company; over 56 % of companies increased the number of pages this past year. The number of pages has increased by nearly a half‑page over the past year.

• Risk‑factor count: The average number of risk factors per company was 32. Even with the number of risk factors stabilizing, 37 % of companies still increased the number of risk factors this past year.

• Risk‑factor summaries: Most companies did not need to include a summary (required only if the disclosure exceeds 15 pages). The average summary length was 1.6 pages, with 28 % of companies including a summary (up from 25 % the prior year).

• Headings: The average number of headings per company was five across all five years; over 50 % of companies used the same number of headings each year. The average number of risk factors per heading was six. Seventy‑five companies had significantly more—20 to as many as 54—risk factors under a single heading during the fifth year.

• Common heading categories: Legal/regulatory/compliance; business; operational; financial; cybersecurity/IT/data security/privacy; common stock; economic and macro‑economic conditions; indebtedness; strategic transactions; industry; strategic; human capital; intellectual property; market; international operations; tax and accounting.

• General risk‑factor heading: Nearly one‑third of companies used a “general risk factors” heading each year, contrary to SEC guidance. Companies averaged about five risk factors under this heading, ranging from one to 17 in the fifth year. The most common factors included natural and man‑made disasters, economic conditions, talent recruitment/retention, stock price volatility, litigation, climate change, cybersecurity, internal‑control weaknesses, tax‑law changes, dividends/stock repurchases, and reputation.

---

Insights on Quarterly Report Risk‑Factor Updates

The first months of the second Trump Administration were highly dynamic, with several executive orders on trade policy, including tariffs that often prompted reciprocal measures. Amid this environment, many S&P 500 companies filed their annual reports disclosing material risks and, a few months later, their quarterly reports. SEC regulations require companies to update their annual‑report risk‑factor disclosures with any material changes in their quarterly reports.

Our review of the annual reports filed between November 9, 2024 and May 9, 2025 and the first quarterly reports filed after April 2, 2025 for 427 companies found:

• Only one‑quarter (94 companies) reported material changes and updated their risk‑factor disclosures.

• 30 companies restated their risk factors in full in the quarterly report, amending between six and 44 risk factors (21 of these amended fewer than 20). Among them, 29 mentioned trade policy, 13 mentioned government funding/contracting, and 17 mentioned corporate sustainability reporting.

• 64 companies added one to seven stand‑alone risk factors (most added a single factor) and referenced the annual‑report disclosure. Of these, 52 mentioned trade policy, seven mentioned government funding/contracting, and two mentioned corporate sustainability reporting.

• 333 companies reported no changes. About two‑thirds explicitly stated no “material” changes; a few referenced other sections of the quarterly filing; a small number provided no risk‑factor section at all.

---

Considerations

• Update risk‑factor disclosures in quarterly reports. Companies should assess whether their risk factors have materially changed before filing quarterly reports. If so, SEC regulations require an update. The SEC discourages unnecessary restatement of entire risk‑factor sections; instead, firms should amend only the changed factors and reference the appropriate filing(s).

• Integrate external risk‑factor disclosure with internal ERM reporting. Aligning external disclosures with internal enterprise risk‑management processes can streamline updates and improve consistency with the SEC’s goal of “disclosure that is more in line with the way the registrant’s management and its board of directors monitor and assess the business.”

• Aim for specificity, avoid boilerplate. More specific language helps satisfy the spirit of the SEC’s amended requirements.

• Use risk taxonomies for headings. Leveraging internal (or external) risk taxonomies can produce more meaningful headings and improve readability.

• Shorten sentence length. The average sentence in many disclosures remains overly long; adopting plain‑English standards (≤ 20 words per sentence) would enhance readability for investors.

---

Conclusion

During this fifth year of implementation of the SEC’s amended requirements, risk‑factor disclosures of 427 S&P 500 companies have continued to lengthen. Given the risk factors added or amended in quarterly reports this season—particularly those related to trade policies—it is possible that disclosures will become even lengthier in the 2026 reporting season.