Caveats to the research The data set is limited and results may have limited applicability to a broader population of companies. The reviewed disclosure language is limited to Item 1.A in the 10-K regulatory filing. Companies may provide additional disclosures about their risks, such as in sustainability reporting, press releases and other sections of the 10-K (such as Item 7.A or the management discussion and analysis (MD&A) section). Each company’s use of subheadings and subtitles in Item 1.A — and by extension, its individual approach to grouping selfidentified risks — served as the basis for our definition of separate, individual risk factors. Risk factors were categorized into 17 different “buckets” to both adjust for company-specific variations in how the risk factors were discussed and normalize the data. This approach potentially lends a bias to results by leading some readers to infer that some topics were “not discussed” in the disclosure when they may have been referenced, if only briefly. For example, a word search may pick up references to risks not necessarily reflected at the category level. Disclaimers: ! The general language used in disclosures may not fully reflect the relative importance of specific risk factors to individual companies.

Sector-focused analysis is based on averages for the sector and these numbers may differ from an individual underlying company. ! Length of disclosure does not necessarily correlate to quality, although some readers may infer that it does, given the study’s look at word and page counts. ! The research represents disclosures as of a single point in time, fiscal year ended 2014, and may not reflect ongoing changes in corporate disclosures following calls by policymakers and investors for more meaningful disclosure.     The  risk  factor  disclosure  landscape  |   27 .