Updating risk factors is an important part of the process of preparing a company’s annual report on Form 10-K or Form 20-F pursuant to the rules of the US Securities and Exchange Commission. Item 503(c) of Regulation S-K requires a plain English explanation of how risks impact the company and its securities. This presentation must specifically identify significant factors that add risk to an investment.

The complete set of risk factors must appear in the annual report on Form 10-K or Form 20-F. Therefore, now is the right time for calendar year public companies to review the entirety of their risk factor disclosures to determine if there are any new risks that should be discussed and if there are any existing risk factors that should be modified.

The risk factors should not be a generic discussion of risks that could impact any company or any securities but must be tailored for the specific issues affecting the company as the operating environment changes—and 2016 was a year of change. Some key risk factor topics to consider at this time, either as stand-alone risk factors or intertwined as part of other risk factor discussions, include the following:

Cybersecurity. Awareness of the significance of cybersecurity from both an economic and a security perspective has grown dramatically over the past few years. There is a greater recognition that cybersecurity is an issue that impacts companies of all types and that cybersecurity risks are increasing. Accordingly, companies should assess whether they need to expand or revise their cybersecurity disclosures to avoid potentially incomplete or misleading disclosure, especially in light of any events that may have occurred over the past year, whether or not such events were particular to them.1

Climate Change and Sustainability.

Sustainability and climate change have garnered increasing attention, including in the context of risk factor disclosure. Climate change risk factor disclosure may discuss the impact of existing or pending legislation, regulation or international accords, as well as the physical impact of climate change or the impact of public awareness of sustainability issues on a company’s business. To the extent deemed relevant, a risk factor could also discuss uncertainties with respect to potential changes in climate change regulation and treaties under the new US administration. Because climate change is an evolving area, the necessity for and scope of a climate change and sustainability risk factor is something that a company should carefully consider when preparing its upcoming annual report on Form 10-K or Form 20-F, as well as future annual reports.

Changes in US Administration. As the Trump presidency and new Congress get under way, it is too early to predict the changes in law and regulation that may result from the change in administration. However, there are a number of areas that have been publicly targeted for change that could impact the risk profile of certain companies. For example, companies in the health care or insurance industries may face risks relating to the Affordable Care Act and possible replacements. Some companies may be facing increased risks with respect to potential withdrawal or modification of international trade agreements. Others may be concerned about changes in tax policy, such as the elimination of renewable energy tax credits or significant changes to the current system. Some companies have already begun to include risk factor disclosure relating to the change in the US administration. As the disclosure season progresses, issuers are encouraged to monitor developments regarding legislation and regulatory shifts, even if only proposed. 

Brexit. Following the United Kingdom referendum last summer in favor of leaving the European Union, some companies began including Brexit risk factors in their periodic reports to address political, social and economic uncertainty, as well as stock market volatility and currency exchange rate fluctuations. For example, Brexit has been mentioned in the context of risk factors on topics such as currency exchange rates, global economic conditions and international operations, as well as having been discussed as a separate risk factor. Brexit is an ongoing process that will take some time to fully negotiate and implement. The BBC reports that Prime Minister Theresa May intends to trigger the process to initiate the negotiations for the terms of the UK’s separation from the European Union by the end of March 2017, meaning the United Kingdom will be expected to leave the European Union by the summer of 2019.2 As Brexit progresses, impacted companies should continually evaluate whether Brexit poses a risk to them and what level of Brexit-related disclosure is appropriate under the circumstances. This disclosure may need to continue to evolve over the next couple of years.

Energy Sector. The energy sector continues to reel from the decline in oil prices that at their lowest point in 2016 fell more than 70 percent from their June 2014 levels. Given the general economic conditions and the competition inherent in the industry, energy companies are looking at an unpredictable future. In addition to those topics set forth above, the primary risks that should be considered by energy companies, where applicable, are fluctuations in the price and volatility of oil, gas or energy commodities; supply risks; political, regulatory or legislative developments; operational and exploration and production risks; limited access to capital or indebtedness; inaccurate reserve estimates; hydraulic fracturing regulation; changes in and level of demand; shortage of rigs and equipment or personnel; and exposure to and use of hedging and derivative instruments.

Practical Considerations. Each company should consider its specific risk profile when determining if its risk factor presentation is sufficiently comprehensive and current. If a topic is not relevant for a company, the company should not include it as a risk factor, even if many other companies do. Likewise, if a company has a unique risk, that risk should be discussed even if other companies do not disclose a comparable risk factor. Foreign private issuers should consider specific jurisdictional or regional risks unique to their particular geography.

The topics highlighted above are not the only areas to consider as part of an annual review of risk factor disclosure. The past year had many developments that may have impacted companies’ risk profiles. Companies may be facing increased risk due to terrorism and related security costs. Fluctuations in currency rates and commodity prices also may have significant impact. Political turmoil and changes in various parts of the world might affect business. There may be industry-specific developments that present risks for certain companies. Companies should assess whether their existing risk factors are adequate to cover recent developments.

Companies should review risk factors of similarly situated companies to identify topics to consider for disclosure in their own risk factors, including updates that have been presented in quarterly reports over the past year. 

In addition to deciding what revisions are needed from a factual point of view, each company should review its risk factor discussion to be sure it is clearly presented in relation to the company and does not merely contain a boilerplate discussion of general risks.

If a risk factor update could materially impact a company’s financial results, it may also be appropriate for that company to discuss that aspect in the management’s discussion and analysis, or comparable section, of its annual report on Form 10-K or Form 20-F.