About the Risk Deep-Dive
The Risk Deep-Dive surfaces what could materially go wrong, what the impact on earnings would be, and what management is doing about it. Risks the company itself has flagged carry more weight than risks the market is just talking about.
Why this section exists
Public companies are required to disclose material risks. That makes the risk factors section of the 10-K an unusually honest part of the business literature: management has a legal incentive to surface what could hurt the company, even when it would prefer not to. The Risk Deep-Dive starts there and works outward.
We separate risks the company itself has named from risks we've found from elsewhere. The first carry the weight of management's own admission. The second are still useful but should be weighed against the company's response and the surrounding evidence - not just the headline.
What to look for
- Which risks are likely to materialize within your investment horizon
- How big the earnings impact would be if the risk plays out
- Whether management has a credible mitigation, or just a hopeful one
- Whether the company has flagged the risk itself
How we build it
We start with the risk factors section of the most recent 10-K, then enrich it with risks discussed on the latest earnings call (often more current than the annual filing) and recent news that names a risk in concrete terms. Each risk gets an estimated earnings impact and a mitigation read.
Generic risks (recession, currency volatility, cyber attacks) are deprioritized when they apply to almost any company. Specific risks (a customer concentration, a regulatory case, a supply disruption tied to a named vendor) get more weight because they materially differentiate the underwriting.
Primary sources
The risk factors section of the 10-K is the spine of this analysis. Other sources fill in what the filings haven't yet caught up with.
Descriptive sections of recent SEC filings
Risk factors are the primary source. Where the description is generic, we mark the risk as low-differentiation; where it's specific to the company, it gets more weight.
Earnings call transcripts
Often surfaces risks more recent than the last 10-K. Also useful for reading whether management has a real mitigation plan or only a talking point.
Third-party analyses
Sometimes flag risks the company itself has not yet disclosed - but treated cautiously, since analysts also have their own theses to defend.
Targeted web search
For naming concrete events - regulatory filings, lawsuits, supplier disruptions - within the last thirty days.
How to read it
Match each risk against your time horizon. A regulatory case that could resolve in three years is a different concern for a long-term holder than for a swing trader, and the same disclosure can be either highly relevant or nearly noise depending on how long you intend to hold.
Check whether mitigation is concrete or aspirational. 'We are diversifying our customer base' on its own is a hope; 'we have signed three new strategic accounts and reduced top-customer concentration from 35% to 28% over the last year' is a plan. The difference matters.