Financial Statement Footnotes: Three Risks on Page 90

Financial statement footnotes are the part of the filing where a company attaches numbers to its own story. Three of them change the picture of a business more than the entire letter from the CEO: customer concentration, debt covenants and going-concern language. The first tells you who actually writes the cheques. The second, who the company made promises to. And the third says whether the auditor believes the firm reaches the next filing.

All three are public, free and barely read. A headline is written to be read. A footnote is written because the law requires it. The second job produces the more honest document.

Where financial statement footnotes sit#

The footnotes come after the four statements: balance sheet, income statement, cash flow statement and the statement of changes in equity. In a US annual report they are the notes to the financial statements, and the risk factors sit somewhere else entirely, near the front of the document. Two different texts written by two different departments: the notes by accounting, the risk factors by lawyers.

A note gives you a number, a risk factor describes a scenario. So read an annual report in pairs: take the sentence in the risk factors that worries you, then go find the number standing behind it in the notes.

The footnotes also hold everything that will not fit in a table: revenue recognition policy, debt maturities, lawsuits and other contingent liabilities, related-party transactions, events after the reporting date. Plenty of it is dull by design and stays dull. The three items in this post always carry a number, and each answers a different question about the business.

One customer, one third of revenue#

At what share does a single buyer start deciding a company's results? Not at the point where it is simply the largest, because a big customer is not a scaled-up version of a small one. Past a certain share it stops buying on the company's terms and starts setting its own: price, payment terms, delivery schedule, and often what gets designed and by when. A contractor who takes nine jobs in ten from one firm is not running a business, only working without a notice period.

What that looks like in numbers is on file at Cirrus Logic. In its annual report for the fiscal year ended March 2026 the company wrote: "we had one end customer, Apple Inc., who purchased through multiple contract manufacturers and represented approximately 91 percent […] of the Company's total net sales" (10-K, Cirrus Logic). The ellipsis stands in for the two earlier fiscal years, 89% and 87%. No other customer or distributor there passed 10% of net sales.

Which means nine dollars in ten of that company's revenue depend on a product calendar written inside somebody else's building.

Ten percent is the level at which a buyer reaches the note at all, and both filings quoted here say so in their own words. In its fiscal 2025 report Skyworks went no further than saying Apple "constituted more than ten percent of our net revenue" (10-K, Skyworks), and left the exact share out. That is information too: the company disclosed the threshold, not the number.

Say a business with a billion in revenue and a 10% operating margin, so 100m of operating profit. One buyer accounts for 350m of the sales. It only has to negotiate a price 10% lower and 35m leaves operating profit, which is more than a third of it. The company lost no customer and shipped no fewer units.

The same buyer leaves a second trace almost nobody looks at, in the receivables note. Companies disclose there how much of the unpaid invoices sit with the largest customers. If one of them is two thirds of receivables on a third of sales, it is the slowest payer in the book, and the supplier's working capital is financing that buyer's balance sheet.

The worst version of this dependence is not the customer leaving for a rival. It is the customer stopping because it now builds the thing itself, and then it is not a contract that disappears but the whole line of business.

I think the level worth watching is not 10% but somewhere around a third of revenue. Above that I stop reading a company as itself and start reading it partly as its largest buyer: that buyer's cycle, its margins, and its standing temptation to make the same component in-house.

When customer concentration is not a verdict#

A share on its own does not settle the question, because in some industries concentration is a description of the job rather than a fault. A defence supplier depends on government budgets because nobody else buys fighter jets, and one contract running a decade can be steadier there than a thousand small orders. Dependence also reads in both directions: if a component cannot be replaced, the buyer needs the supplier just as badly. A maker of lithography machines sells to a dozen or so customers worldwide, and it is those customers who queue.

So the right question is not: does the company have one giant buyer? It is: does that buyer have anywhere else to go, and does the company still set its price? You find the answer where the balance of power in the value chain is visible, in the competitive pressure map and in the analyst questions on the earnings call. Rising sales with a falling margin in the segment serving that buyer is an answer in itself.

The concentration hiding in the channel#

The most misleading companies are the ones with a million customers where three of them decide everything. A food brand sells to hundreds of thousands of shoppers, and a handful of retail chains decide its shelf space. An app developer has crowds of users and reaches them through two app stores.

So in the footnotes look for distributors as well as customers: filings give their shares separately, and the real bargaining power usually sits in the channel rather than with the end user. The effect is the same as with one giant client, only harder to spot, because the user-count chart keeps climbing neatly through every quarter in which the commercial terms get worse. Follow the money, not the user.

Covenants, or what the company promised the bank#

The second item differs from the first in having a hard threshold and a date. A covenant is a condition attached to a loan agreement. Some are ratios: net debt to EBITDA below one level, interest cover above another, read as a count of years rather than as a quotient. Some are prohibitions: no new debt, no dividend above a limit, no sale of named assets. In the filing it sits in the note on borrowings and in the liquidity section, usually as one paragraph ending with a line saying the company was in compliance at the balance sheet date.

That line is reassuring and it is the least interesting part of the note.

The headroom is the interesting part.

Say net debt of 400m and EBITDA of 100m, so 4.0x, against an agreement that allows 4.5x. Half a turn of headroom looks respectable until you convert it into profit: EBITDA falling 12%, to 88m, pushes the ratio past 4.5x and breaks the condition. Which means one weak year, one eighth of profit, and debt that was long-term yesterday lands among current liabilities on the balance sheet.

A breached covenant rarely means immediate enforcement. It means the lender may demand repayment, so the loan moves to the current column and management goes to the bank for a waiver. The waiver costs: a higher margin on the loan, a fee, a tighter condition for next year, and normally a ban on dividends and buybacks.

Cross-default clauses, under which a breach of one agreement counts as a breach of all of them, can then drag in the other lenders. One broken condition starts a conversation with the whole financing structure at once.

Some conditions only wake up when the company reaches for money. A revolving facility can carry a clause under which the ratio applies from the moment drawings pass some fraction of the limit. While the company sits on cash the covenant formally does not exist, and in the quarter it draws the facility both problems arrive together. You will not read that off the leverage ratio, only off a sentence in the note, and that sentence is usually one line long.

Sometimes the note gives no threshold at all and points to the credit agreement instead. Then you go looking for it among the exhibits to the filing, where large financing agreements are filed in full, definitions of the ratios included. It is twenty minutes of reading and the only place that shows whether EBITDA in the loan agreement means what EBITDA in the investor presentation means.

Read a covenant comparatively, not nominally. You do not care that the ratio is 4.0x; you care what percentage of profit stands between the company and the limit, and how that distance moved over the last four quarters.

When the auditor clears their throat about going concern#

The third item is the shortest and the heaviest. The auditor is required to evaluate the company's ability to continue as a going concern for a period "not to exceed one year beyond the date of the financial statements being audited" (PCAOB, AS 2415). If substantial doubt survives that evaluation, a separate explanatory paragraph goes into the opinion and a going-concern note into the statements.

Which means it is not a bankruptcy forecast and not a verdict. It is a sentence about twelve months: the money the company holds and has secured does not cover the coming year.

Companies usually arrive at that sentence after several quarters that were visible earlier and elsewhere. Negative working capital, which is more owed within a year than can be turned into cash inside one. Debt maturing within twelve months that nobody has rolled over yet. Negative operating cash flow for the third year running. Every one of those sits in the statements long before the auditor writes anything about going concern, so the warning rarely surprises somebody who read the footnotes. It surprises somebody who read the headlines.

In that note you are looking for a plan with a date. A signed refinancing, an asset sale with a closing date or a declared shareholder support letter are a different thing from a sentence about management intending to raise finance. You can check the first in the next filing. The second is only an intention. So one note can mean "it is tight but we have a plan" or "we are counting on somebody lending to us", and the difference shows up in whether it contains a signature or an adjective.

The sentence also has a habit of accelerating the thing it describes. Suppliers shorten payment terms, banks raise the margin on the loan, and some customers stop signing multi-year contracts with a firm whose auditor wrote that it may not last the year. Which is why management fights to keep that paragraph out, and why its appearance carries more weight than the rest of the note.

Does every risk in the footnotes matter#

The strongest objection to all of this reading sounds sensible: if everything is public, the market already knows. Risk-factor sections are also mostly legal padding, where the loss of a major customer stands next to pandemics, cyberattacks, weather and a rule change in a country the company does not sell into. Anyone who has read three such lists is entitled to treat the fourth as a form.

Fair enough.

Except that disclosed and read are two different things.

Three questions separate a risk from padding: does it carry a number, did it change against last year's filing, and does it name a counterparty, a threshold or a date. Concentration, covenants and going concern answer yes to all three. Weather answers none of them.

The cheapest of those tests is putting two consecutive filings side by side. A sentence deleted or added this year is a sentence somebody inside the company decided was necessary, and there are usually a handful of those changes in an annual report, not a hundred. You then work through the whole section in order, sorting structural risks from execution and one-off ones. After that, I ask every risk claim for the citation behind it, because without one all that is left is tone. Losing the largest buyer or breaching a loan condition is not daily noise either, but an event that changes the company, which is what Major news is for. Nothing in Monitoring costs Credits.

I do not believe a risk list that has not changed in three years. It is not an assessment, it is a form somebody copied forward. And I do not know whether the market prices covenant headroom in a company that reports it once a quarter. I do know when it finds out, because it finds out on the day the company asks the bank for a waiver.

Three footnotes to open this week#

Take one company you consider yourself to know well and open its latest annual report. It takes about fifteen minutes.

1. Segment and major-customer note: write down the largest customer's share and the same share a year earlier. The change matters more than the level.
2. Note on borrowings: write down the covenant and convert the headroom into a percentage of EBITDA, not into turns of the ratio.
3. Audit opinion: read it to the end and check whether an explanatory paragraph follows the opinion paragraph.

Where these risks sit in the report#

The risks section of a Full report collects the same three items, each with a citation to the document it came from, so a sentence about concentration or a covenant can be read in the original instead of trusting a confident paraphrase. Monitoring watches them afterwards, so keeping an eye on these three is not a budget decision, only a decision about whether you want to see them. See what else a Full report checks.

Check the largest customer's share and the covenant headroom every quarter, on the day the numbers come out. Both move faster than the story about the company, and both live in the footnotes.