A recent paper by four law professors takes a look at risk factor disclosures in Form 10-Qs and 10-Ks filed by 3,000 firms from January 2020 through the end of 2023. Stephen Choi, Mitu Gulati, Xuan Liu, and Adam Pritchard, Covid-19 Risk Factors and Boilerplate Disclosure. As the title suggests, the authors focused on risk factor disclosures related to the Covid-19 pandemic. Like Captain Renault, I'm shocked, shocked to learn that they found pervasive copying of prior risk factor disclosures:

Real world disclosure practices of public companies are a far cry from the SEC’s model of individualized disclosure of “material” risks. Instead, we find evidence, across a range of measures, of “follow the leader” copying of initial disclosures that results in a considerable amount of boilerplate. And that boilerplate is then slow to change, even when the facts on the ground have evolved. These latter findings fit better in a model where companies, concerned about the costs of disclosure, make the choice to do individualized disclosure only when there are benefits to them beyond satisfying the SEC’s general
mandates.

I discussed this problem and even offered a less than hyperbolic solution about a decade ago in this post:

The Securities and Exchange Commission should create a list of standard risk factors and issuers should be required to incorporate by reference all applicable risk factors into their filings. They would only be permitted to disclose risks that aren't on the list. Thus, the SEC would create a standard risk factors such as "competition", "dependence on key personnel", and "natural disaster". A further refinement would be to create a subset of industry-specific risk factors. For example, there could be additional risk factors for pharmaceutical companies, technology firms, et cetera. If necessary, an issuer would be permitted to supplement the standard risk factor with additional information. For example, a company might incorporate by reference the natural disaster risk factor and add "In addition, the registrant's principal factory is located on an active earthquake fault in a flood zone that is routinely swept clean by hurricanes." Another company might incorporate the dependence on key personnel by adding "The average age of our senior management is 94 and they all smoke."

Alas, the SEC has not adopted my rather modest proposal. Until it does, the drafting of risk factor disclosures may continue to be summarized in one word - "plagiarize".