Retail risk management: the top risks 98 retailers disclose
Good retail risk management starts with knowing which risks your peers actually face. Grocers, apparel chains, home and electronics stores, auto dealers and specialty retailers live on thin margins, seasonal peaks and imported stock. We counted how many of 98 US-listed store-based retailers disclose each risk in their latest annual report, and compared the result with fourteen other industries. Businesses that sell mainly online have their own ecommerce benchmark.
Every retailer in our sample discloses cyberattack risk (100%), and nearly all disclose intense competition (98%). Only two risks are distinctive to store-based retail — failing to anticipate changing customer preferences and foreign sourcing disrupted by trade restrictions — but consumer spending, inflation, supply chains and store staffing are much more common than elsewhere.
- Cyberattack exposing data and disrupting operations: 100% of retailers (84% on average in the other fourteen industries). Internal IT system failure: 70% (42%).
- Weaker consumer discretionary spending: 82% (22% elsewhere).
- Failure to anticipate changing customer preferences: 55% (9% elsewhere).
- Foreign sourcing disrupted by trade restrictions: 38% (0% elsewhere), alongside tariffs at 66% (29%).
- Inflation outpacing prices (58% vs 26%), supplier failure and supply chain disruption (55% vs 7%) and frontline and store staff shortages (45% vs 6%).
Turn this list into your own risk registerRisk Samurai starts you with the risks typical for retailers, then helps you score them, assign owners and track actions.
Get early accessHow we built this. We took the Risk Factors section of the latest annual report of 98 US-listed retailers on SEC EDGAR (filed 13 March 2025 to 26 October 2026), recorded every disclosed risk and grouped equivalent risks across companies. “Share” is the percentage of retailers whose filing discloses the risk. Disclosure is not likelihood: filings are written by lawyers, are over-inclusive and come from public companies that are mostly larger than a typical small business, and shares are approximate. Full method and caveats.
Who is in the sample
The benchmark covers 98 retailers: all 98 filed a Form 10-K, with filing dates between 13 March 2025 and 26 October 2026. By SEC industry code (SIC), the group is made up of 13 auto dealers and petrol stations (5500), 10 miscellaneous retail (5900), 9 variety stores (5331), 8 grocery stores (5411), 6 family clothing stores (5651), 6 apparel and accessory stores (5600) and 46 in other codes.
In plain words, these are mostly large chains: median annual revenue is about $4.7 billion, the highest median of the fifteen industries, with the smallest company at around $5.1 million and the largest around $713.2 billion. The median filing yields 49 distinct risks (range 18–95). Auto dealers and petrol stations are the largest single group, followed by miscellaneous and variety stores, grocers and apparel chains. Most of these businesses also sell online, but their model is built around physical stores.
| Measure | Value |
|---|---|
| Companies | 98 |
| Annual reports | 98 × 10-K |
| Filing dates | 13 March 2025 – 26 October 2026 |
| Annual revenue | median $4.7 billion; smallest $5.1 million; largest $713.2 billion |
| Risks identified per filing | median 49 (range 18–95) |
| Company-level risks the filing explicitly calls new this year | 4.3% |
The top 30 risks retailers disclose
The table ranks risks by the share of retailers whose annual report discloses them. The last column is the average share across the other fourteen industries in our study, so you can see at a glance whether a risk is generic to listed companies or particular to this sector. Risks marked distinctive are disclosed by at least 20% of retailers and by at least 15 percentage points more than in any other industry.
| # | Risk | Retail companies | Other industries (avg) |
|---|---|---|---|
| 1 | Cyberattack exposing data and disrupting operations Hacking, malware or ransomware against company systems exposes confidential or personal data and disrupts operations, causing liability, regulatory penalties, financial loss and reputational damage. | 100% | 84% |
| 2 | Intense competition eroding share and pricing Larger, lower-cost, private-label or new competitors undercut prices or outperform on products, causing loss of customers, market share and margins. | 98% | 68% |
| 3 | Weaker consumer discretionary spending Falling consumer confidence, inflation or high interest rates reduce discretionary spending, lowering traffic, sales and margins on consumer offerings. | 82% | 22% |
| 4 | Adverse litigation and legal proceedings Lawsuits, claims and legal proceedings may produce adverse judgments, settlements and defence costs exceeding insurance, diverting management and harming reputation. | 70% | 63% |
| 5 | Internal IT system failure or outage Failure, defect or interruption of internal information systems could halt transaction processing and services, causing financial loss, data loss and reputational harm. | 70% | 42% |
| 6 | Tariffs raising input and sourcing costs New or retaliatory tariffs and trade restrictions on imported goods, materials and equipment raise costs and constrain supply, compressing margins where costs cannot be passed on. | 66% | 29% |
| 7 | Acquisitions fail to integrate or deliver benefits Poor selection, valuation or integration of acquired businesses diverts management and disrupts operations, so expected synergies and returns are not realised and results suffer. | 63% | 74% |
| 8 | Adverse changes in tax laws and rates Changes in domestic or foreign tax laws, rates or interpretations increase effective tax rates and cash taxes, reducing earnings and cash flow. | 59% | 52% |
| 9 | General regulatory change and non-compliance Changes in, or failure to comply with, laws and regulations across jurisdictions may raise compliance costs, bring penalties or licence loss and force operational changes. | 58% | 35% |
| 10 | Inflation outpacing prices and recovery Inflation in labour, materials, energy and operating inputs rises faster than prices, rents or reimbursement can adjust, compressing margins and profitability. | 58% | 26% |
| 11 | Supplier failure and supply chain disruption Failure, capacity limits or external disruption at key suppliers may interrupt the supply of goods, causing shortages, higher costs and lost sales. | 55% | 7% |
| 12 | Failure to anticipate changing customer preferences distinctive Shifts in customer tastes, trends or behaviour that we fail to anticipate reduce demand for our offerings, causing lost share, markdowns and excess inventory. | 55% | 9% |
| 13 | Product defects, recalls and liability claims Design, manufacturing or supplier quality failures make products unsafe or defective, triggering recalls, injury claims and enforcement action, with costs, lost sales and reputational harm. | 51% | 13% |
| 14 | Natural disasters damaging facilities and operations Natural disasters, severe weather or other catastrophes damage offices, stores or other premises, interrupting operations and service delivery and reducing revenue. | 45% | 26% |
| 15 | Frontline and store staff shortages Tight labour markets and high turnover may hinder recruiting frontline, store and hourly staff, causing understaffing, weaker service and reduced trading hours. | 45% | 6% |
| 16 | Evolving privacy laws raising compliance costs New, changing and inconsistent privacy laws across jurisdictions require costly changes to systems and practices, raising compliance costs and exposure to penalties. | 44% | 41% |
| 17 | Debt covenant restrictions and breach Restrictive covenants constrain operations, and a breach or cross-default allows lenders to accelerate debt, halt funding and enforce security over assets. | 43% | 42% |
| 18 | Loss of senior executives or key employees Unexpected departure of senior executives or key employees without ready replacements could disrupt operations, impair strategy execution and harm financial results. | 42% | 56% |
| 19 | General insurance inadequate, unavailable or costly Insurance limits, exclusions, insurer disputes, rising premiums or unavailability leave property, catastrophe and liability losses uninsured and increase costs. | 41% | 41% |
| 20 | Seasonal and weather-driven demand swings Concentrated peak seasons and unseasonal weather cause uneven sales, capacity strain and inventory mismatches, so a weak peak sharply reduces annual results. | 41% | 15% |
| 21 | Ineffective internal control over financial reporting Weak internal controls or unremediated material weaknesses may cause misstated or late financial reports and restatements, leading to sanctions and loss of investor confidence. | 39% | 54% |
| 22 | Pandemic disruption to operations and demand A pandemic or public health crisis and related restrictions could disrupt workforce, suppliers and customer demand, reducing revenue and straining liquidity. | 39% | 34% |
| 23 | Extreme weather disrupting facilities and operations More frequent and severe extreme weather damages facilities, infrastructure and supply chains, interrupting operations and service delivery and causing repair costs and uninsured losses. | 38% | 18% |
| 24 | Foreign sourcing disrupted by trade restrictions distinctive Reliance on overseas suppliers exposes supply to trade restrictions, political instability and logistics disruption, reducing product availability and raising costs. | 38% | 0% |
| 25 | Inadequate protection of own intellectual property Weak registration, protection or enforcement of proprietary technology and rights allows competitors to copy or misappropriate it, eroding competitive advantage and revenue. | 37% | 44% |
| 26 | Substantial indebtedness constraining cash flow High leverage, including further permitted borrowing, diverts cash flow to debt service and limits flexibility, increasing vulnerability to downturns and default. | 37% | 42% |
| 27 | Geopolitical conflict disrupting economy and markets Wars, terrorism and geopolitical tensions destabilise economies, energy prices, supply chains and financial markets, raising costs and reducing demand, asset values and results. | 35% | 21% |
| 28 | Goodwill and intangible asset impairment Weaker performance, forecasts or market valuations reduce the fair value of goodwill and intangible assets, requiring non-cash impairment charges that reduce earnings and equity. | 35% | 34% |
| 29 | Credit market disruption limiting financing access Disrupted or tightening credit and capital markets or higher rates restrict access to borrowing and refinancing, raising financing costs and pressuring liquidity. | 33% | 17% |
| 30 | Insufficient cash flow to service debt Operating cash flow falling short of debt service and other obligations forces asset sales, restructuring, costly refinancing or default. | 32% | 17% |
Cyber is universal in retail: every filing in the sample discloses it. Retailers hold card data and loyalty-programme records for millions of customers, and point-of-sale, inventory and distribution systems all have to work for a store to trade — which is why internal IT system failure (70%) ranks fifth. A breach or outage during peak season is the scenario most retailers would least like to face.
The middle of the list is about the customer’s wallet and the cost of goods. Weaker discretionary spending, inflation outpacing prices, tariffs (66%) and supply chain disruption all squeeze a business whose margin is a few cents in the dollar. Product defects, recalls and liability claims (51%) come with selling other companies’ products under your own name, and seasonal and weather-driven demand swings (41%) explain why a poor holiday season can define a retailer’s year.
Physical stores bring physical risks. Natural disasters damaging facilities (45%) and extreme weather disrupting operations (38%) both rank in the top 30, as does a tight retail labour market. Finally, a group of financing risks — credit market disruption (33%) and insufficient cash flow to service debt (32%) — reflects the leverage many chains carry.
What is distinctive about retailers
Only two risks meet our strict test for being distinctive to retail (disclosed by at least 20% of retailers and at least 15 percentage points more often than in any other industry). A third, currency translation, meets the test only because retailers’ mentions of it were grouped separately from the general currency risk that other industries disclose, so we leave it out. Store-based retail shares most of its characteristic risks with ecommerce and hospitality. We cover the two distinctive risks, plus three areas that do not meet the test but are far more common here than across other industries.
Failure to anticipate changing customer preferences
55% of retailers disclose it, against 9% on average in the other industries.
Retailers commit to ranges months before they reach the shelf, so a misread trend shows up as excess stock, markdowns and lost share to competitors who read it better. The risk is sharpest in apparel and home goods but applies to any retailer whose customers can switch easily. Shorter buying cycles for fashion-sensitive lines, test-and-reorder for new products, and weekly sell-through tracking against plan with agreed markdown triggers limit the damage.
Foreign sourcing, trade restrictions and tariffs
“Foreign sourcing disrupted by trade restrictions”: 38% (other industries 0%). “Tariffs raising input and sourcing costs”: 66% (other industries 29%).
Much retail merchandise is made overseas, often in a few countries. Trade restrictions, political instability and port or shipping disruption can delay product or make it much more expensive, and tariff changes go straight to margin. Know your sourcing by country for each category, keep approved alternative suppliers for the highest-volume lines, and agree with buyers in advance how tariff costs will be shared, passed on or absorbed.
Consumer spending and inflation (not formally distinctive)
“Weaker consumer discretionary spending”: 82% (other industries 22%). “Inflation outpacing prices and recovery”: 58% (other industries 26%).
Ecommerce companies disclose weak consumer spending even more often, so it fails our distinctiveness test, but it is the macro risk that dominates retail. When household budgets tighten, customers trade down and buy less, while wage, rent and freight inflation keeps pushing costs up. Plan against a downside sales scenario as well as the base case, know which costs flex with volume and which do not, and track gross margin by category weekly in difficult periods.
Frontline and store staff shortages (not formally distinctive)
45% of retailers disclose it, against 6% on average in the other industries.
Restaurants and hotels disclose this risk more often, but it is several times more common in retail than the average elsewhere. Understaffed stores lose sales, see more shrinkage and cut opening hours. Track vacancy rates and turnover by store, monitor the hours of trading lost to staffing gaps, and treat scheduling, pay competitiveness and manager quality as the controls they are.
Supply disruption and product safety (not formally distinctive)
“Supplier failure and supply chain disruption”: 55% (other industries 7%). “Product defects, recalls and liability claims”: 51% (other industries 13%).
Retailers depend on suppliers to deliver on time and to make products that are safe. A supplier failure leaves gaps on the shelf; an unsafe product brings recalls, claims and damage to the retailer’s own brand, especially for private-label lines. Supplier scorecards for on-time delivery and quality, product testing for regulated categories, batch traceability and a rehearsed withdrawal process are the core controls.
The category mix
Every identified company-level risk is classified into one of nine groups. The table shows how retailers’ risk mentions split across them — a rough picture of where their attention goes, not of where losses come from.
| Risk group | Share of risk mentions |
|---|---|
| Strategic | 29.1% |
| Financial | 19.7% |
| Operational | 19.2% |
| Compliance and legal | 14.7% |
| ESG and sustainability | 5.4% |
| IT and cyber security | 4.7% |
| People | 4.3% |
| Reputational | 2.1% |
| Project | 0.7% |
Strategic risks lead at 29.1% of mentions, followed by financial (19.7%) and operational (19.2%), with compliance and legal at 14.7%. The operational share is second only to ecommerce among the fifteen industries, which fits a business built on stores, distribution centres, suppliers and staff. ESG and sustainability (5.4%) reflects weather, climate and responsible-sourcing expectations.
How to use this in your own risk register
A benchmark is a checklist of what peers disclose, not a risk assessment of your business. Use it to spot gaps, then do the real work yourself.
- Pick. Read the distinctive risks and the top ten first. Tick the ones that genuinely apply to your business model, size and markets, and drop the rest. Grocers should keep food safety, inflation and staffing items; fashion and home retailers should weight changing preferences, sourcing and seasonality; auto dealers should add manufacturer and financing dependencies of their own.
- Rewrite for your business. Filing wording is deliberately generic. Turn each risk into a specific statement of cause, event and consequence — see what a risk register is for the format.
- Score likelihood and impact. Score each risk on your own risk matrix. Do not use the share column as a likelihood: it measures how many companies mention a risk, not how often it happens.
- Name an owner and controls. Each risk needs one accountable person and a short list of the controls that actually reduce it today.
- Add indicators. Pick one or two key risk indicators for the risks that score highest, with thresholds that trigger action.
For example, “Failure to anticipate changing customer preferences” becomes: “Our autumn womenswear range, ordered six months ahead from overseas suppliers, sells through well below plan, forcing early markdowns that cut seasonal gross margin and leave excess stock in our distribution centre.” That version names the category, the lead time and the consequence, and points to controls such as shorter buying cycles and markdown triggers.
Indicators that suit retailers include:
- Sell-through against plan for the current season, by category.
- Weeks of stock cover, with upper and lower limits for key lines.
- Share of purchases from the single largest sourcing country.
- Store vacancy rate and trading hours lost to staffing gaps.
- Critical vulnerabilities in point-of-sale and payment systems older than the patching target.
Stores take card payments at scale, so the PCI DSS compliance checklist is the natural companion to the cyber risks above. If you also sell online, our guide to ecommerce fraud and chargebacks covers card-not-present fraud and disputes.
Frequently asked questions
What are the biggest risks for retailers?
In 98 US retail annual reports, the most widely disclosed risks are cyberattack (100% of companies), intense competition (98%), weaker consumer discretionary spending (82%), litigation (70%) and internal IT system failure (70%).
Which risks are specific to retail?
Only two risks are distinctive in our strict sense: failing to anticipate changing customer preferences (55% vs 9% on average in fourteen other industries) and foreign sourcing disrupted by trade restrictions (38% vs 0%). Several more are far more common than average: supplier and supply chain disruption (55% vs 7%), product defects and recalls (51% vs 13%), frontline staff shortages (45% vs 6%) and inflation outpacing prices (58% vs 26%).
How should an independent shop or small chain use this list?
Start with the risks that apply at any size: card data and IT systems, consumer demand, suppliers and sourcing, stock, staffing, product safety and weather. Rewrite each for your stores and categories, score it on your risk matrix and give it an owner. Listed-company items such as internal control over financial reporting can usually be left out.
How was this list built?
From the Risk Factors section of the latest annual report of 98 US-listed retailers on SEC EDGAR. We recorded every distinct risk each section discloses, grouped equivalent risks across companies and counted the share of companies disclosing each one.
Does a higher share mean a risk is more likely?
No. The share measures how many companies chose to disclose a risk, not how often it happens or how much it costs. Annual reports are written by lawyers to protect the company, so they are over-inclusive: a risk can appear in nearly every filing and still be unlikely in any given year. Score likelihood and impact for your own business separately.
Start your register from this benchmark
Risk Samurai uses this benchmark to suggest the risks companies in your industry typically face — cyber, consumer demand, sourcing, inventory and store staffing risks for a retailer — when you build your register. You then rewrite, score and assign owners to them.
Get early access