Industry risk benchmarks: what 1,098 annual reports disclose

Which risks do companies in your industry worry about, and which are particular to your sector? We read the Risk Factors sections of 1,098 annual reports filed by US-listed companies in fifteen industries and counted how many companies disclose each risk. The result is a free, ranked list of risks per industry that you can use as a starting point for your own risk register.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 12 min read

What this is

Every company listed in the US must describe the most significant risks it faces in the Risk Factors section of its annual report. Those sections are long, repetitive and written by lawyers, but taken together they are the largest public record of what businesses in each industry consider material. We used them to build a benchmark: for each industry, which risks are disclosed, by how many companies, and how that compares with other industries.

The benchmark is designed for people building or reviewing a risk register: a founder starting from a blank page, a risk manager checking coverage, or a board member asking “what are our peers worried about that we are not?”. It is also what Risk Samurai uses to suggest risks for your industry.

The fifteen industries

Each card shows the number of companies in the sample and the three most widely disclosed risks, with the share of companies disclosing each. Open an industry for the full top 30, the distinctive risks with practical interpretation, the category mix and guidance on using it.

Risks that appear in most industries

Some risks are disclosed so widely that they are better described as risks of being a listed company than of being in a particular industry. The table shows the nine risks that appear in the top 30 of at least eleven of the fifteen industries, with the share of companies disclosing them in each.

* Not in that industry’s top 30. The value shown is the share of the 30th-ranked risk in that industry, so the true share is at most this figure.

Cyberattack is the closest thing to a universal risk: it is in the top ten of every industry and the single most widely disclosed risk in eight of them. Acquisitions that fail to deliver are almost as common, because most listed companies grow partly by buying others. Litigation and the loss of senior executives or key employees complete the set of risks found in all fifteen top-30 lists.

The gaps are informative too. Generic “intense competition” is missing from the bank and real estate top 30s because those companies describe competition in their own terms — competition for loans and deposits, tenant demand and re-letting. Internal control over financial reporting is outside the insurance top 30, and AI regulation is outside the top 30 in six industries — real estate, construction, manufacturing, logistics, retail and hospitality — not because those companies ignore these risks, but because other risks crowd them out.

For your own register, the practical point is this: the common risks are worth including almost everywhere, but they will not differentiate your risk profile. The distinctive risks on each industry page are where peers’ experience is most useful.

Method

We set out to answer a simple question — which risks do companies in an industry disclose, and how often — as transparently as we could. The steps:

1. Sample. For each of fifteen industries we selected US-listed companies by SEC industry code (SIC), with some manual curation where codes are a poor fit (ecommerce, video games and media, where companies were added or excluded by hand based on their business description). We took each company’s latest annual report on SEC EDGAR: Form 10-K for US companies, Form 20-F for foreign private issuers, and in two cases a 10-KT transition report. In total that is 1,098 companies, with filing dates from 28 January 2025 to 26 October 2026; the range for each industry is shown below.
2. Section. From each report we took only the Risk Factors section — Item 1A of Form 10-K or Item 3.D of Form 20-F. We did not use management discussion, financial statements or other sections.
3. Risks. We recorded every distinct risk the section discloses, including risks embedded inside broader risk factors, with a short statement, a category from our risk taxonomy and whether the filing explicitly says the risk is new this year. Results were checked against a sample of reports reviewed in full.
4. Grouping. Companies describe the same risk in different words. We grouped equivalent risks across all companies into shared risk definitions, each with a title and a one-line statement. The titles and statements on our pages are those group definitions, not quotations from any filing.
5. Counting. For each industry we counted how many companies disclose at least one risk in each group.

Definitions

• Share — the percentage of companies in the industry whose filing discloses the risk. A company counts once, however many times it mentions the risk.
• Other industries (avg) — the simple average of the risk’s share across the other fourteen industries.
• Distinctive — a risk disclosed by at least 20% of companies in the industry and by at least 15 percentage points more than in any other single industry. This is a strict test: a risk that is common in two industries (for example, weak consumer spending in both ecommerce and video games) is distinctive for neither.
• Category mix — the share of all company-level risk mentions in the industry that fall into each of nine groups: strategic, financial, compliance and legal, operational, IT and cyber security, people, reputational, ESG and sustainability, and project.
• New this year — the share of company-level risks that the filing itself explicitly describes as new or emerging. Most filings do not flag this, so it is a lower bound.

The sample by industry

* Each industry page lists at most 15 distinctive risks, the most widely disclosed first; “15+” means more risks meet the test.

Caveats: read before you use the numbers

• Disclosure is not likelihood. A share tells you how many companies chose to mention a risk, not how often it happens or how much it costs. Rare but severe risks can be widely disclosed; frequent, minor ones may not be disclosed at all.
• Filings are lawyer-written and over-inclusive. Risk Factors sections exist partly to protect companies from litigation, so they tend to list every plausible risk and change slowly from year to year.
• These are public US companies. They are mostly larger than a typical small or mid-sized business, and some risks (internal control over financial reporting, share price volatility, tax loss carryforward limits) mainly concern listed companies. US-specific regulation appears throughout.
• Classification involves judgement. Some risks buried inside long risk factors will have been missed, and grouping occasionally splits one risk into two or merges wording from different contexts. Treat shares as approximate.
• Samples are modest. Industries range from 30 to 98 companies. In the smallest sample, one company moves a share by more than three percentage points.
• No company names. We publish aggregates only; the pages describe industries, not individual companies.

How to use the benchmarks

Open your industry, read the distinctive risks and the top ten, and tick the ones that genuinely apply to your business. Rewrite each one as a specific risk statement for your organisation, score it on your own risk matrix, assign an owner and add key risk indicators for the ones that matter most. Each industry page includes a worked example and suggested indicators. If you need a format to put them in, start from our free risk register template.