Based on recent case law, “De-Risking Your Risk Disclosures” from Morrison & Foerster suggests companies consider two important tweaks to their risk factor disclosures, subject to their specific facts and circumstances:
- Add a statement to the effect that disclosure of a risk does not mean that the risk has not already materialized.
- If a previously disclosed risk has materialized, companies should not represent that there have been no material changes to their previously disclosed risk factors and should consider disclosing that the risk has manifested and may manifest in the future.
While the sound guidance is offered in the context of cybersecurity risk disclosure, it applies more broadly to risk factor disclosure in general.
Access additional resources on our Financial Reporting page »Risk Factors.
This post first appeared in the weekly Society Alert!