How to Read 10-K Risk Factors: A Map, Not a Horoscope

10-K risk factors are the only section of an annual report where a company is legally on the hook for writing down what could hurt it. You read it like a map of the terrain, not like a horoscope. You are hunting three things: risks that are specific rather than boilerplate, sentences whose wording changed since last year, and risks you can attach an observable trigger to. The length of the list tells you nothing. A change in the list tells you almost everything.

Where 10-K risk factors actually sit#

In a US annual report, meaning the Form 10-K, the risks have a number: Item 1A, right after the business description and before management's discussion of results. The SEC's own investor bulletin describes the section as "information about the most significant risks that apply to the company or to its securities" and notes that companies generally list them in order of importance. That ordering is free information about a hierarchy management chose, not one you imposed.

In many European annual reports the same content has no number at all. Risk factors live inside the management report, the half of the document an auditor does not examine the way it examines the financial statements. That changes the legal status of the sentence, not how you read it.

Since 2020 the regulator has added a built-in page counter. The amended disclosure rules require "summary risk factor disclosure of no more than two pages if the risk factor section exceeds 15 pages". Which means the SEC counted the pages, decided the section had grown past the point of being readable, and made companies bolt a two-page summary onto the front. For you that is a free gauge: if a summary greets you at the top, you know without scrolling that fifteen-plus pages are waiting underneath.

Fifteen pages of weather warnings and nothing about the route.

There is one more property the name does not advertise. The section inventories threats and says nothing about what the company is doing about them. For that you go to the management discussion and to the Q&A on the earnings call, where someone finally asks out loud.

Three kinds of terrain, not one list#

Dozens of entries, all written in the same register and roughly the same length: where do you start? Read top to bottom and the list blurs somewhere around item ten. Sorting them into three kinds of terrain while you read, rather than after, fixes that.

First comes structural ground, which holds what is built into the business: regulation, customer concentration, industry cyclicality, dependence on one technology shift. Second is operating ground, covering execution: supply, people, quality, data security, capacity. Third are the one-off events, which is to say lawsuits, recalls, regulatory decisions, acquisitions.

The sorting is not tidiness for its own sake. A structural risk belongs in your thesis, because it is the mirror image of whatever protects the company from competition, and it resolves over years. Execution resolves over quarters, so it belongs in ongoing monitoring. An event belongs in neither until it happens, which is why you can read that ground fastest.

Say the section tells you two customers account for 40% of revenue. That is not an operating note, however much it reads like one. It means two commercial conversations a year decide two fifths of the revenue, which means this company's price depends on somebody else's budget more than on its own costs.

The same sorting settles the reading order for the whole report. I open the risk section before the CEO letter, because the letter was written to impress and the risk section was written so the company cannot be sued. Read the letter first and every risk sentence sounds like a formality. Read them the other way round and the letter becomes an answer to questions you already have.

Specific beats scary#

Risk factors are written by lawyers, and they are written so the company cannot later be accused of staying quiet. That sets the default wording as wide as possible, because a wide sentence costs nothing. A narrow sentence costs something, since it can be checked and someone can be held to it.

Which is exactly why narrow sentences are the valuable ones. In Nvidia's annual report for fiscal 2023, the export risk carries product names. The new licence requirements, the company writes, "specifically impact our A100 and H100 integrated circuits, DGX or any other systems or boards which incorporate A100 or H100 integrated circuits and our A100X". Elsewhere in the same document sits a sentence about hiring, citing "our industry's highly competitive market for skilled workers". The first names two product lines and the named export markets. The second fits every technology company on the planet.

So the first sentence converts into a question with an answer: how much revenue went to those markets, and what happened to that slice over the next four quarters. The second converts into nothing.

The difference comes in degrees, not two states. "We operate in a competitive market" says nothing. "We depend on a small number of customers" is already a sentence about this company. "Our largest customer accounted for X% of revenue" is a number you can find in a note and compare with last year. The further down those steps you go, the fewer the words and the more the work.

Boilerplate has exactly one use, so do not dismiss it out of hand. Open a company from an industry you do not know and the generic list tells you what that industry has to think about at all. A drugmaker worries about patent expiry and reimbursement, an airline about fuel and labour, a bank about credit quality. That is orientation in the terrain, not information about this one company, and by the second company in the same industry it stops adding anything. Useful once. Never twice.

Specific does not mean likely. It means checkable, and that is the only property that hands you a task instead of a mood.

What Boeing did not write#

Investing folklore says the risk section "saw" Boeing years before the fleet was grounded. I opened both filings and counted.

In Boeing's annual report for 2018, filed 8 February 2019, three months after the Lion Air crash, the risk-factor section runs roughly 5,500 words and mentions the 737 MAX not once. That is about twenty typed pages, so this is not a section anyone missed through haste. Certification risk is described there. What it names is a different programme: "the introduction of new aircraft programs and/or derivatives, such as the 777X, involves increased risks associated with meeting development, testing, production and certification schedules".

The name 737 MAX appears eleven times in the same document, every one of them outside the risk section: in the business description, in the delivery-schedule table, in the discussion of results. The risk section described a class of exposure and never named the programme the exposure ran through.

It would be dishonest to say there was nothing there. The same filing describes dependence on regulatory approvals, on the health of the whole production system, and on reputation for safety standards. All three played out a year later, exactly as written. None of them pointed at the programme through which they played out.

So the map had a category of terrain marked and no road.

That is the healthiest lesson this section teaches, and I rate it above every "things to watch out for" list ever published: risk factors are not a forecast and were never meant to be one. I do not know whether anyone could have read the February filing and seen what happened a month later. I do know there was nothing in the risk section to read it from, and that any account claiming otherwise is running on memory of the crash rather than on the document.

So why read it at all?

One word changes the tense#

The answer sits in the next filing. In Boeing's annual report for 2019, filed on 31 January 2020, the first risk factor reads: "The 737 MAX fleet is currently grounded, and we have temporarily suspended production of the 737 MAX". Across that section the programme is named twenty-four times against zero a year earlier, and the section itself grows from roughly 5,500 words to roughly 6,500.

The verb matters more than the volume. Boeing writes that the grounding "has reduced revenues, operating margins, and cash flows", not that it could. That risk moved from conditional to actual, which is to say it stopped being a risk and became a line in the income statement.

That shift is the cheapest information in the entire document, because finding it takes two files and a search box. No model, no subscription, nobody's interpretation, and the result is binary: either the tense changed or it did not. Cheap, and hard to argue with. It works in the other direction too. A risk that quietly disappears or softens is a question, especially when nothing in the company's environment obviously improved.

Two years side by side is the whole trick, really. One year reads like a list of the hazards facing every company alive. Two years read like a record of what moved in this one.

How to read risk factors year over year#

Principles do not do much until they turn into a few moves you make the same way every time. Mine go like this:

1. Open the risk section of the latest filing and the one from a year earlier, in two windows side by side.
2. Cross out every sentence that could be pasted into another company's filing without changing a word.
3. From what survives, pick three entries and give each its ground: structural, operating, event.
4. Write one sentence under each: what exactly I would see if this started to happen, and in which document I would see it.
5. Set a date to check. For most entries that is the next quarterly report; for regulatory ones, usually sooner.

Step four is what separates reading from note-taking, and it is the only one you cannot rush. Customer concentration is watched in the note on major customers and at contract renewal. Regulatory exposure is watched in draft rules and agency decisions, not in headlines. Data security is watched in reported incidents and in a sudden jump in protection spending.

A sentence you cannot attach a trigger to stays a warning nobody ever checks.

The whole routine takes an hour on your first company and twenty minutes by the third, because from the second year on you are only reading differences.

Three risks, not thirty#

The method has one flaw, and it is better named before somebody trips over it. Triggers multiply easily, since every entry in the section converts into a condition, and the section has dozens of them. Thirty conditions are zero conditions, because you will check none of them.

It breaks the other way too. Read the section as a list of prophecies and after three companies you conclude that every business on the exchange is about to fold, and you stop reading anything. Asking whether a hazard could happen is pointless, because the company just answered yes and that is what the section is for. The useful questions are four: how specific, how severe, has it changed, and what would I see first.

So the cap sits at three, five at the very most, and it covers only the risks your actual view of the company rests on. The rest gets read and set down, so that reading a filing does not turn into following the news every day. Three well-chosen entries last a year, and the company will remind you of them itself by filing them again.

Which of the three is genuinely yours? The one whose change would force you to change your mind about the company. The rest is background, even though it reads identically.

From a sentence to a condition#

In Taufolio the same work has two homes. The Full report collects a company's key risks out of the documents and shows the source next to each, so step two is already done and what is left to you is deciding which three sentences are yours. Alerts are the product form of step four: a condition written in your own words that Taufolio watches and comes back on once it resolves. The Free plan has no room for alerts; the paid plans do.

The risk section will not tell you what is going to happen. It tells you where the cliffs are drawn on the map of a business, and the rest of the work is checking once a year whether any of them moved closer to the road. If you want to see what those risks look like pulled out of the documents with the source attached, see it inside the product.