Data Stories · Corporate Disclosure

The Risk Section That Ate the 10-K

In 2005 the SEC told public companies to list their risk factors. Ninety-one thousand annual reports later, the risk section has tripled in length, grown harder to read every single year, and never once deleted a fear.

Who this data represents US SEC registrants that filed annual 10-K reports with a substantive “Item 1A: Risk Factors” section, fiscal years 2006–2020. Mentions measure disclosure language written by securities lawyers, not underlying risk.

91,493

risk-factor sections, one per company-year

2.9×

growth in the median section: 3,788 → 11,008 words

15 / 15

years in which median length grew. It never once shrank.

3% → 79%

share of filers mentioning cyber risk, 2006 → FY2019

Every public company in America files an annual report, and since December 2005 every annual report must contain Item 1A: a list of things that could go wrong. The mandate created a genre overnight — and because the SEC's EDGAR archive keeps everything, we can watch that genre being born, one fiscal year at a time, across 91,493 filings.

The genre's defining trait revealed itself immediately: risk language accumulates and never dies. The median risk section grew in every single one of the fifteen years in our window — from 3,788 words in 2006 to 11,008 by fiscal 2020. No recession, no calm stretch, no editorial fashion ever made it shorter. Lawyers add the new fear; nobody is ever paid to remove an old one.

Figure 1 · Birth of a boilerplate

Median Item 1A length and reading difficulty, by fiscal year

Top: median words per risk section. Bottom: median Gunning-fog proxy — already at “unreadable” (a fog of 17+ means post-graduate effort) in 2006 and drifting steadily worse. Longer and denser: whatever these sections do, easing comprehension is not it.

A quirk worth knowing: EDGAR-CORPUS labels filings by fiscal year. A “FY2019” 10-K was typically filed in early 2020 — mid-pandemic — which is why COVID language appears one year “early.”

Watching companies learn a word

Because every filer faces the same disclosure decision every year, the corpus works like a national anxiety survey with a legal budget. When does a risk enter the corporate imagination? Track the share of filers whose Item 1A mentions each theme:

Figure 2 · Word watch — share of filers mentioning each theme

Percent of Item 1A sections with ≥1 match, by fiscal year, 2006 – 2020

Each panel is dated by real events. Cyber inflects after the SEC's October 2011 disclosure guidance and accelerates after the Target breach (FY2013). Brexit materializes from zero exactly in FY2016. Pandemic language sat at ~20% for a decade of laundry-list boilerplate — then 61% in FY2019 filings (written in early 2020) and 96% in FY2020. Terrorism, the oldest fear in the window, starts high and still rises — boilerplate never retires. AI barely exists by FY2020; the corpus ends two years before ChatGPT.

Three patterns stand out. Regulatory nudges work: the single biggest inflection in the cyber panel is not a breach but a guidance document — the SEC's 2011 statement that cyber incidents may be material. Shocks synchronize: Brexit and COVID enter thousands of filings within a single reporting cycle, which is what it looks like when the same law firms advise everyone. And ratchets don't reverse: every panel that rises stays risen; the only theme that ever declined meaningfully is Brexit, and only after it stopped being a forecast and became a fact.

The next chapter of this series will use the underlying text — 1.1 GB of it, shipped alongside these aggregates — to measure the copy-paste index: how much of each company's risk section survives, verbatim, from one year to the next. The hypothesis, given everything above: almost all of it.