To search annual reports for risk disclosures, look in Item 1A "Risk Factors" of a US Form 10-K, and in the "risks and uncertainties" section of the board of directors' report plus the accounting notes of a Nordic annual report. We tag those pages by topic, so one annual report search for a risk returns the cited passage and its page, whether the company files with the SEC or reports in Helsinki or Stockholm.
Below we show where the risk text lives in each format, how to phrase the query, and three real passages: Costco Wholesale Corporation (Nasdaq: COST), KONE Oyj (Nasdaq Helsinki: KNEBV) and Sandvik AB (Nasdaq Stockholm: SAND).
Annual report search: where risk disclosures sit in a 10-K and a Nordic annual report
The table summarises where each format puts its risk text and what that means for a search.
| US Form 10-K | Nordic annual report (IFRS) | |
|---|---|---|
| Main location | Item 1A, Risk Factors; Item 1C for cybersecurity governance | "Risks and uncertainties" in the board of directors' report |
| Other places | Item 7A (market risk), MD&A | Financial risk notes, critical estimates and judgements, sustainability statement |
| Language | English | English, Finnish or Swedish, depending on the report version |
| Length | Often many pages of headed risk factors | Usually a few pages, with detail in the notes |
Source: our summary of SEC Form 10-K structure and the reports cited below.
The practical consequence: in a 10-K, restricting the search to Item 1A finds most of the answer. In a Nordic report, the same risk can appear in the board of directors' report and again, with numbers, in a note. A useful annual report search for risk has to cover both.
How to phrase a risk query so it finds the right passage
Name the risk, add synonyms
"Cybersecurity attacks, data breach, IT disruption" works better than "cyber". The search ranks by meaning, so synonyms widen the net without adding noise.
Filter to risk pages
Restrict to pages tagged as risks and uncertainties. For a US filer this lands in Item 1A; for a Nordic filer it covers the report section and the notes.
Pin the fiscal year
Risk factors are rewritten every year. Pin the year, then run it again for the prior year to see what was added.
Three cited risk passages: Costco, KONE and Sandvik
Costco: cybersecurity in 10-K Item 1A
Costco's FY2026 10-K (fiscal year ended 30 August 2026) states in Item 1A, page 11:
"The rapid evolution of AI has automated and accelerated the scale of cybersecurity threats, potentially reducing the time for us to detect and mitigate potential information security incidents."1
The same search also returned Item 1C, Cybersecurity, where Costco describes how it manages that risk, including assessments against the NIST Cybersecurity Framework and CIS 18 Critical Security Controls. Item 1A says what could go wrong; Item 1C says what the company does about it.
KONE: cyber and geopolitical risk under "Most significant risks"
KONE's FY2025 financial statements, under "Most significant risks" on page 26, put cybersecurity next to geopolitics:
"Continued geopolitical tensions and escalations may lead to cyber, hybrid and even conventional attacks causing local and global disturbances that may impact KONE, our customers and our suppliers."2
On the next page, page 27 of the financial statements, KONE names a market-specific financial risk: it "is exposed to risks related to liquidity and payment discipline of its customers, which may impact cash flow or lead to credit losses, especially in China."3 It then refers the reader to the notes for detail, which is the typical Nordic pattern.
Sandvik: physical climate risk inside an accounting note
Sandvik's clearest climate risk sentence in its FY2025 report sits in note G13 (property, plant and equipment), under critical estimates and key judgements, on page 133:
"There are production sites in areas with physical climate risks, these may be subject to increased stress from physical weather events."4
A keyword search for "risk factors" would not find this sentence, because it is in a note about asset impairment, not in a section called risks. A topic-tagged search did.
What the comparison shows
- The same risk, different homes. Costco and KONE both disclose cybersecurity risk; Costco in a dedicated 10-K item, KONE in a short "Most significant risks" section of its financial statements that refers to the notes for detail.
- Nordic detail sits in the notes. Sandvik's climate risk sentence is in an impairment note, where a search limited to a "risks" heading would never look.
- Language matters. Some Nordic annual reports are indexed in Finnish or Swedish. Adding the local term (for example "riskit ja epävarmuustekijät" or "risker och osäkerhetsfaktorer") to the query helps the search find them.
Run the same query with the prior fiscal year. Costco's FY2025 and FY2026 Item 1C passages on risk management are nearly identical, which tells you the change, if any, is in Item 1A. Comparing two years of risk text is often the quickest way to see what management has started to worry about.
Search risk disclosures from Claude, ChatGPT or clarifo.com
You can run these searches on clarifo.com, inside Claude or ChatGPT through our read-only MCP app, or through the Data API's filing content search endpoint. Every result carries the company, document, fiscal year, section and a link to the page. A prompt to start with:
Using Clarifo, search Costco's FY2026 10-K Item 1A and KONE's FY2025 annual report for cybersecurity risk. Quote one sentence from each with its page link, and say whether the disclosure is in a dedicated risk section or in the notes.
For more on how Clarifo works inside ChatGPT, see Clarifo in ChatGPT. For an example of reading one filer beyond the headline numbers, see how to use Clarifo to read NVIDIA.
Search risk sections across US 10-Ks and Nordic annual reports, with the page link on every passage.
- Costco Wholesale Corporation, FY2026 Form 10-K (fiscal year ended 30 August 2026), Item 1A Risk Factors, p. 11: SEC EDGAR. Item 1C Cybersecurity in the same filing: SEC EDGAR.
- KONE Oyj, 2025 financial statements (FY2025), "Most significant risks", p. 26: report page.
- KONE Oyj, 2025 financial statements (FY2025), p. 27: report page.
- Sandvik AB, 2025 financial statements (FY2025), note G13, critical estimates and key judgements, p. 133: report page.
Not investment advice. Figures are based on data reported by the companies.