Data Stories · Corporate Disclosure

The Risk Section That Ate the 10-K

In 2005 the SEC told public companies to list their risk factors. Ninety-one thousand annual reports later, the risk section has tripled in length, grown harder to read on net, and almost never deleted a fear — because three-quarters of it, measurably, is last year's section pasted forward.

Who this data represents US SEC registrants that filed annual 10-K reports with a substantive “Item 1A: Risk Factors” section, fiscal years 2006–2020. Mentions measure disclosure language written by securities lawyers, not underlying risk.

91,493

risk-factor sections, one per company-year

2.9×

growth in the median section: 3,788 → 11,008 words

14 / 14

year-over-year transitions in which median length grew. It never once shrank.

3% → 79%

share of filers mentioning cyber risk, 2006 → FY2019

Every public company in America files an annual report, and since December 2005 every annual report must contain Item 1A: a list of things that could go wrong. The mandate created a genre overnight — and because the SEC's EDGAR archive keeps everything, we can watch that genre being born, one fiscal year at a time, across 91,493 filings.

The genre's defining trait revealed itself immediately: risk language accumulates and almost never dies. The median risk section grew in every single one of the fourteen year-over-year transitions in our window — from 3,788 words in 2006 to 11,008 by fiscal 2020. No recession, no calm stretch, no editorial fashion ever made it shorter. Lawyers add the new fear; nobody is ever paid to remove an old one.

Figure 1 · Birth of a boilerplate

Median Item 1A length and reading difficulty, by fiscal year

Top: median words per risk section. Bottom: median Gunning-fog proxy — already dense in 2006, dipping slightly in 2008–09, then climbing without interruption from 2010 on. Longer and, on net, denser: whatever these sections do, easing comprehension is not it.

A quirk worth knowing: EDGAR-CORPUS labels filings by fiscal year. A “FY2019” 10-K was typically filed in early 2020 — mid-pandemic — which is why COVID language appears one year “early.”

Watching companies learn a word

Because every filer faces the same disclosure decision every year, the corpus works like a national anxiety survey with a legal budget. When does a risk enter the corporate imagination? Track the share of filers whose Item 1A mentions each theme:

Figure 2 · Word watch — share of filers mentioning each theme

Percent of Item 1A sections with ≥1 match, by fiscal year, 2006 – 2020

Each panel is dated by real events. Cyber inflects after the SEC's October 2011 disclosure guidance and accelerates after the Target breach (FY2013). Brexit materializes from zero in FY2015 and jumps into double digits in FY2016. Pandemic language climbs steadily through the 2010s — from 6.5% (2006) to 19.6% (2018) of laundry-list boilerplate — then jumps to 61% in FY2019 filings (written in early 2020) and 96% in FY2020. Terrorism, the oldest fear in the window, starts high and mostly keeps rising, with one dip after 2007 — boilerplate rarely retires. AI barely exists by FY2020; the corpus ends two years before ChatGPT.

Three patterns stand out. Regulatory nudges work: the single biggest inflection in the cyber panel is not a breach but a guidance document — the SEC's 2011 statement that cyber incidents may be material. Shocks synchronize: Brexit and COVID enter thousands of filings within a single reporting cycle, which is what it looks like when the same law firms advise everyone. And ratchets mostly don't reverse: most panels that rise stay risen. The two meaningful declines are Brexit — after it stopped being a forecast and became a fact — and a smaller dip in terrorism language after 2007, before it resumed climbing for the rest of the window.

The copy-paste index

If risk language accumulates and never dies, most of it should be recycled — and the underlying text lets us measure exactly that. Split every Item 1A into sentences, normalize them, and ask: what share of this year's sentences appeared, verbatim, in the same company's section last year?

Figure 3 · The copy-paste index

Median share of a filing's sentences carried verbatim from the same firm's prior-year Item 1A · continuing filers

Three-quarters of the risk section is last year's risk section. The median filer's verbatim carryover climbs from 67% (FY2007) to a ~78% plateau by the mid-2010s (shaded band: interquartile range). The only two dips are the fiscal years when reality intruded — 2008 and 2020. It takes a global financial crisis or a pandemic to make corporate America rewrite its own boilerplate, and even then the median filer keeps more than 60% of it. The thin line at the bottom is cross-firm boilerplate: the share of sentences appearing verbatim in five or more different companies' filings the same year — small but tripling, from 1.6% to 5%.

So the ratchet in Figure 1 is even lazier than it looks: sections grow not because they are rewritten longer each year, but because new fears are appended to a stack of old sentences that nobody deletes. And the dips confirm the mechanism by exception. In FY2008 the median carryover fell five points; in FY2020 — sections hurriedly rewritten around COVID — it fell six. Genuine shocks are visible in this corpus precisely as interruptions in copying.

The cross-firm series tells a second story: risk sections are not just self-plagiarized but increasingly industry-plagiarized. By FY2020, 263 different companies shared the exact sentence “compliance with, and monitoring of, applicable laws and regulations may be difficult, time consuming and costly,” and 248 shared the genre's great disclaimer: “the risks and uncertainties described below are not the only ones we face.” Much of the most-shared FY2020 language is SPAC and JOBS-Act template text — the fingerprint of the same law firms drafting everyone's fears.

Verbatim reuse is measured on distinct normalized sentences of ≥60 characters, so it is a sentence-level floor on recycling: lightly edited sentences count as new. A shingle-based similarity measure would push the reuse estimates higher still.