Risk Factor vs. MD&A Disclosure Requirements: What Goes Where in 2026

If your disclosure team treats Item 105 (risk factors) and Item 303 (MD&A) as two independent checklists, you are building a comment letter. The SEC's Division of Corporation Finance reviews both sections together, cross-checks them against your earnings call transcripts, and flags internal inconsistencies as a standalone deficiency. Getting the allocation right matters for Rule 10b-5 exposure, PSLRA safe harbor availability, and the basic coherence of your filing.

This guide gives CFOs, general counsel, and ESG teams a concrete decision framework for 2026: what belongs where, what the legal consequences of misallocation are, and how to manage the interaction between the two sections as risks evolve across their lifecycle.

Key takeaway: A risk that has materialized into a known trend must appear in both Item 105 and Item 303. Disclosing it only in risk factors does not satisfy the MD&A obligation, and the SEC has said so explicitly.

What Is the Difference Between Risk Factor and MD&A Disclosure?

Item 105 (risk factors) and Item 303 (MD&A) serve fundamentally different disclosure purposes, governed by different legal standards. Conflating them is the single most common structural error in periodic report drafting.

The foundational distinction: risk factors describe what could go wrong. MD&A describes what has happened, what is happening, and what is reasonably likely to happen, with management's quantified analysis of the drivers. A risk factor is inherently probabilistic. An MD&A trend disclosure is grounded in known facts and management's affirmative assessment.

What Is a Risk Factor Disclosure Under Item 105?

A risk factor disclosure is a material, company-specific warning about a circumstance that could adversely affect the registrant's business, financial condition, or results of operations. The 2020 amendments to Item 105, effective February 10, 2021, changed the standard from disclosing the "most significant" risk factors to disclosing "material" risk factors. In practice, that change had almost no effect: a Deloitte/USC Leventhal study of 439 S&P 500 filers found that 64% of companies actually increased their number of risk factors after the amendments, with the average rising from 30.1 to 30.6 per company.

The 2020 amendments introduced three structural requirements practitioners must know:

1. Material standard. Disclose risk factors that are material to the company, not merely the most significant subset. Generic, boilerplate risks that apply to any public company are the SEC's primary comment target.
2. Risk factor summary. If the risk factor section exceeds 15 pages, a summary is mandatory. Only 19% of the 439 S&P 500 companies studied exceeded that threshold, well below the SEC's estimate of 40%. Most companies that did include a summary simply bulleted verbatim subcaptions rather than drafting genuinely concise summaries.
3. General Risk Factors heading. Generic risks that do not relate specifically to the registrant must be grouped at the end of the risk factor section under a "General Risk Factors" heading. This is a structural requirement, not a suggestion.

The generic risk factor problem persists despite the amendments. As Deloitte's Dean Kingsley, Matt Solomon, and USC's Kristen Jaconi noted in their Harvard Law Forum analysis: "The change from disclosure of 'most significant' to 'material' risk factors under the revised rules seemed to have no impact on the average number of risk factors." The SEC's intent to shorten disclosures was not achieved.

The 10-Q Update Obligation

One gap most law firm memos skip: Item 105 requires 10-Q filers to disclose material changes to risk factors from the most recent 10-K. This is not optional. When new information emerges mid-year, such as a cybersecurity incident, a regulatory investigation, or a geopolitical shock affecting your supply chain, the 10-Q risk factor section must reflect it. The interaction between quarterly MD&A updates and quarterly risk factor updates is where many disclosure teams fall short. For a practical example of how this plays out with geopolitical events, see our guide on Q2 2026 10-Q disclosure obligations after the Iran ceasefire collapse.

What Is an MD&A Disclosure Under Item 303?

MD&A is management's obligation to let investors see the company through management's own eyes, not to restate the financial statements, but to explain the economic events, transactions, and trends behind the numbers. As the SEC staff has said in comment letters: "It is not sufficient to merely recite the information that is available on the face of the financial statements without describing the events, transactions and economic changes that materially affected the reported amounts."

The 2020 modernization via Release No. 33-10890 codified several requirements that practitioners frequently misread:

• Reasonably likely standard. A known trend or uncertainty must be disclosed if it (1) is reasonably likely to occur and (2) would, if it occurred, be reasonably likely to have a material impact on revenues, income, liquidity, capital resources, or financial position. This is a lower threshold than "more likely than not" and requires affirmative management analysis, not just disclosure of what has already occurred.
• Quantification of multiple factors. When more than one factor contributes to a material change in a line item, the registrant must quantify the impact of each. Qualitative description alone is insufficient. The SEC staff comment letter pattern is consistent: "please quantify each material component when a change is attributed to more than one factor."
• Off-balance-sheet arrangements. The separately captioned OBS section was eliminated, but material off-balance-sheet arrangements must still be discussed within Liquidity and Capital Resources.
• Contractual obligations table. Eliminated as a standalone table, but material cash requirements from known contractual and other obligations must still be analyzed.
• Inflation and price changes. The standalone inflation discussion was eliminated, but if inflation constitutes a known trend reasonably likely to have a material impact, it must be disclosed. This is a common confusion: companies believe the topic is no longer required when in fact it remains required under the principles-based framework whenever material.
• Cost-revenue relationship. A new explicit requirement to discuss any known events reasonably likely to cause a material change in the relationship between costs and revenues.

The foundational two-step analytical framework, established in Release No. 33-6835 (1989) and codified in the 2020 amendments, still governs: (1) Is the trend, demand, commitment, event, or uncertainty known to management? (2) If known, is it reasonably likely to have a material effect? If both answers are yes, disclosure is required.

The Disclosure Decision Framework: Item 105 vs. Item 303 vs. Both

This is the question every disclosure team faces and the one no top-ranking article answers with a usable framework. Here is the decision logic:

Step 1: Is the risk known to management?

• No: No disclosure required in either section (though you should document the analysis).
• Yes: Proceed to Step 2.

Step 2: Has the risk materialized into a known trend or uncertainty with a quantifiable impact?

• No, it remains hypothetical or probabilistic: Item 105 only. Disclose it as a material risk factor with company-specific language.
• Yes, it has materialized or is reasonably likely to have a material impact: Item 303 required. Also assess whether Item 105 needs updating (see Step 3).

Step 3: Does the existing risk factor accurately describe the current state of the risk?

• If MD&A describes a trend as having already materialized but the risk factor still frames the same risk as hypothetical, the filing is internally inconsistent. Update the risk factor to reflect the changed status: either reframe it as an ongoing operational risk or, if the risk has passed, remove it with an explanation.
• If the risk factor is accurate and the trend is new, add or update the risk factor to reflect the materialized condition.

Step 4: Is there a specific Item 106 (cybersecurity) or other dedicated disclosure item that applies?

• For cybersecurity: a material incident that has occurred belongs in MD&A; the risk of future incidents belongs in Item 105; governance and strategy go in Item 106 under Release No. 33-11216. All three must be coherent.
• For climate: the SEC's 2024 climate rules remain stayed/vacated as of mid-2026, but CF Disclosure Guidance Topic No. 2 (2010) still applies. Material climate risks must appear in Item 105 and, if they constitute known trends, in Item 303 under existing principles-based requirements.
• For AI: the SEC has issued sample comment letters indicating that material AI-related risks must appear in Item 105 and, where AI is a known trend affecting operations or financial results, in Item 303. Generic AI risk factors that do not reflect the company's specific AI use cases are a comment target. See our detailed guide on AI disclosure in your Q2 2026 Form 10-Q.

The Coherence Problem: What Happens When the Two Sections Conflict

This is the gap every law firm memo leaves open. The SEC does not review Item 105 and Item 303 in isolation. The staff reads them together, and it reads them against your earnings releases and earnings call transcripts. Bass Berry's practitioner guidance is explicit: "disclosure counsel should consider whether any disclosure included in the MD&A also gives rise to a need to make corresponding revisions to risk factors disclosure."

Three coherence failures the SEC flags most often:

1. The materialized-but-hypothetical mismatch. MD&A describes a trend as having a material impact on revenue; risk factors still describe the same risk as something that "could" happen. The filing is internally inconsistent. The staff will ask you to reconcile.
2. The disappearing trend. A trend was disclosed in MD&A in Q3. It is simply absent from the Q4 10-K without explanation. The SEC has flagged the unexplained disappearance of previously disclosed trends as a comment issue. Once a trend is disclosed, it generally must be updated, not silently deleted.
3. The earnings call gap. Management discusses a material pricing headwind on the earnings call. The 10-Q MD&A describes the same headwind in qualitative terms without quantification. The staff has commented on exactly this pattern, citing Item 303(b)(2)(ii) of Regulation S-K.

Key takeaway: Disclosing a risk only in risk factors does NOT satisfy the MD&A trend disclosure obligation. The SEC has consistently taken the position that risk factor disclosure is not a substitute for required MD&A analysis. Failure to disclose known trends in MD&A can give rise to Rule 10b-5 liability from private plaintiffs as well as SEC civil enforcement actions, independent of whether the information appeared in risk factors.

The PSLRA Safe Harbor Asymmetry

This distinction is frequently overlooked and has real litigation consequences. The Private Securities Litigation Reform Act safe harbor for forward-looking statements applies to disclosures in MD&A accompanied by meaningful cautionary language. It does NOT apply to financial statement footnote disclosures.

The practical implication: if a known trend is disclosed in MD&A with proper cautionary language, forward-looking statements about that trend carry safe harbor protection. The same information placed in a footnote does not. This creates a strong drafting incentive to locate forward-looking trend analysis in MD&A rather than in the notes, and to ensure that cautionary language is specific and meaningful, not boilerplate.

Note that the PSLRA safe harbor does not eliminate the obligation to disclose known trends in the first place. The safe harbor protects against liability for inaccurate forward-looking statements; it does not protect against liability for omitting required disclosures entirely.

The Most Common SEC Comment Letter Deficiencies in Each Section

Reviewing the SEC's publicly available comment letters on EDGAR is the most direct way to understand what the staff considers deficient. The Deloitte DART roadmap on SEC comment letter considerations for MD&A systematically compiles these patterns.

Item 105 (Risk Factors) Comment Patterns

• Generic risk factors that apply to any public company, not tailored to the registrant's specific circumstances
• Risk factors that describe a risk as hypothetical when MD&A indicates it has already materialized
• Failure to update 10-Q risk factors when new material information emerges during the year
• Risk factor summaries that simply bullet verbatim subcaptions rather than providing genuine synthesis
• AI, climate, and cybersecurity risk factors that are not specific to the company's actual use cases or exposure profile

Item 303 (MD&A) Comment Patterns

• Reciting financial statement line items without explaining the underlying economic events or transactions
• Disclosing macroeconomic trends (inflation, supply chain, labor market) without identifying the company-specific principal factors and their quantified impact
• Failing to quantify the impact of each material factor when multiple factors contribute to a change
• Disclosing a trend qualitatively but not quantifying its impact on revenues, margins, or liquidity
• Deleting a previously disclosed trend without explanation in the subsequent filing
• Failing to disclose the impact of inflation or price changes when those conditions constitute a known material trend, despite the elimination of the standalone inflation discussion requirement

For sector context: Health Care, Financials, Real Estate, and Information Technology sectors had the highest average number of risk factor pages in the Deloitte/USC study, and Energy, Health Care, and Financials showed the greatest year-over-year increase after the 2020 amendments. These sectors also attract the most comment letter activity on both sections.

Emerging Risks: Allocating Climate, Cyber, and AI Across Both Sections

The three risk categories generating the most SEC comment activity in 2026 each require a specific allocation approach.

Climate risk. The SEC's 2024 climate rules (Release No. 33-11275) remain stayed and effectively vacated as of mid-2026 following the Eighth Circuit's June 2024 decision. But the 2010 CF Disclosure Guidance Topic No. 2 survives and instructs registrants to consider climate-related risks under existing Item 105 and Item 303 requirements. A company with material physical or transition risk exposure must disclose it in risk factors and, if it constitutes a known trend affecting revenues or costs, in MD&A with quantification. The vacatur of the new rules does not eliminate the existing obligation. For how this intersects with tariff and supply chain risk, see our guide on tariff disclosures in SEC filings.

Cybersecurity risk. Item 106 (Release No. 33-11216, effective December 15, 2023) created a dedicated governance and strategy disclosure. But Item 105 and Item 303 still apply in parallel: the risk of future incidents belongs in risk factors; a material incident that has occurred and is affecting operations belongs in MD&A; and Item 106 covers the governance overlay. All three must be internally consistent.

AI risk. The SEC's AI disclosure guidance is still developing as of mid-2026. The staff has issued sample comment letters indicating that generic AI risk factors are insufficient. If AI is materially affecting a company's cost structure, revenue model, or competitive position, that belongs in MD&A as a known trend, not just in risk factors as a hypothetical. Our guide on SEC AI financial reporting guidance in 2026 covers the specificity standard the staff is applying.

How ERM Programs Feed Better Disclosure in Both Sections

Companies with mature enterprise risk management programs have a structural advantage in producing coherent, company-specific disclosures that satisfy both the "material" standard of Item 105 and the "reasonably likely" standard of Item 303. A well-maintained risk register, updated quarterly and tied to scenario analysis, provides the factual foundation for both sections and reduces the risk of the materialized-but-hypothetical mismatch.

The Deloitte/USC study recommended that companies leverage existing ERM and ESG reporting practices for their risk factor disclosure process. The same logic applies to MD&A: if your ERM process already quantifies the financial impact of identified risks, that analysis should feed directly into the MD&A trend disclosure, not sit in an internal document while the filing contains only qualitative language.

For ESG teams specifically: sustainability-related risks that are material to the business must flow through the same Item 105 and Item 303 framework as any other material risk. Siloed ESG reporting that does not connect to the periodic report disclosure process is a coherence failure waiting to be flagged.

FAQ

Does MD&A include risk factors? No, they are separate sections of the periodic report. MD&A (Item 303) requires management's analysis of known trends and their quantified impact. Risk factors (Item 105) are forward-looking warnings about what could go wrong. A risk that has materialized must appear in both sections, but they serve different purposes and are governed by different disclosure standards.

What is the difference between the "reasonably likely" standard in MD&A and the "material" standard in risk factors? The "reasonably likely" standard in Item 303 applies to known trends and uncertainties: if a trend is known to management and is reasonably likely to have a material impact, disclosure is required. This is a lower threshold than "more likely than not." The "material" standard in Item 105 asks whether a reasonable investor would consider the risk important. Both standards require affirmative management analysis, not just disclosure of what has already occurred.

What is the "General Risk Factors" heading requirement? Under the 2020 amendments to Item 105, generic risks that do not relate specifically to the registrant must be grouped at the end of the risk factor section under a "General Risk Factors" heading. This is a structural requirement. Company-specific risks should appear in appropriately labeled categories before this heading.

When is a risk factor summary required? A risk factor summary is mandatory when the risk factor section exceeds 15 pages. Only 19% of the 439 S&P 500 companies studied exceeded this threshold. Companies that include a summary must provide genuine synthesis, not verbatim subcaption bullets.

If I disclose a risk in MD&A as a known trend, do I need to update my risk factors? Yes. If MD&A describes a risk as having materialized or as a known trend, the corresponding risk factor must be updated to reflect the changed status. Leaving a risk factor framed as hypothetical while MD&A describes it as an ongoing operational reality is an internal inconsistency the SEC staff flags in comment letters.

Does the PSLRA safe harbor apply to risk factor disclosures? Yes, with meaningful cautionary language. It also applies to forward-looking statements in MD&A. It does NOT apply to financial statement footnote disclosures. This asymmetry is a key reason to locate forward-looking trend analysis in MD&A rather than in the notes.