1. Introduction

Over the last few decades, risk reporting remained as one of the most talked about issues in the corporate domain. The main reasons behind this are the notorious accounting and financial scandals/frauds at the beginning of the 2000s and the credit crunch of 2007 (ACCA, 2014; Amran, Bin, & Hassan, 2008; Epstein & Buhovac, 2006). Over the years, risk reporting got enough attention from the stakeholders globally (Aebi, Sabato, & Schmid, 2012; Beltratti & Stulz, 2012; Nahar, Azim, & Jubb, 2016a). On one hand, it is said that risk disclosure can be helpful for both stakeholders and the companies as this kind of disclosure helps enhancing the confidence of the investors and thus reduces cost of capital (Abraham & Cox, 2007; Linsey & Shrives, 2006; Nahar et al., 2016a). On the other hand, in the corporate world, there also exists a perception that risk reporting can create negative impression among the stakeholders as communicating on ‘risk’ generally means communicating ‘negative’ news (ACCA, 2014). For that reason, though the global community is highlighting the importance of risk disclosure (Nahar et al., 2016a), the practice has not developed in a satisfactory manner (ACCA, 2014; Abraham & Shrives, 2014).

In response to the concern over CRR from the part of the global community, over the last two decades, both academicians and professional bodies have conducted several studies on corporate risk reporting. This article presents a literature survey on corporate risk reporting. In order to conduct this literature survey, the available studies (that were conducted mainly in the last two decades) are reviewed. The main features of these studies are identified. Also, from this review, some literature gaps are identified and several avenues for future research are highlighted.

2. Background of Research

2.1. Corporate Risk Reporting (CRR)

Risk can be defined as the “uncertainty as to the amount of benefits” (Aryani, 2016, p.73). It can be an uncertainty, a threat, a volatility or an opportunity that must be managed by companies (Abraham & Cox, 2007; Aryani, 2016; Muzahem, 2011; Shrand & Elliot, 1998). Linsley and Shrives (2006) defined risk as the positive or negative outcome of events. It is also defined as “uncertainty associated with potential gain and loss” (Solomon, Solomon, Norton, & Joseph, 2000, p.449). These days, organizations are increasingly exposed to risks of different nature and intensity. Epstein and Rejc (2005) classified organizational risks into four major categories: (1) strategic risks, (2) operations risks, (3) reporting risks and (4) compliance risks. These are described in Table 1:

Table 1. Types of Organizational Risks (Epstein & Rejc, 2005)

Epstein and Buhovac (2006) emphasized that risks should be identified and measured. According to Aryani (2016, p.74), risk management is a “… set of methodologies and procedures used to identify, measure, monitor, and control the risks arising from the business activities”. Epstein and Buhovac (2006) mention the following:

Just as senior managers need more complete risk assessments for better management decision-making, external shareholders and other stakeholders are demanding increased reporting of these risks to better evaluate corporate performance. Financial professionals want to provide a clear understanding of the risks and fair disclosure to both internal and external decision-makers without causing unnecessary alarm. (p.5)

Thus, here, the authors highlighted the need for risk management as well as the need for disclosure of risks for the interest of both internal and external stakeholders. Such disclosures will be helpful for users in assessing risk profile of business entities (Linsley, Shrives, & Crumpton, 2006). These reports inform the users on the existing and probable opportunities, prospects and dangers to which the company is or will be exposed (Muzahem, 2011). According to Amran et al. (2008), today’s organizations cannot escape risk and for that reason, it is important that the investors get the information on financial and economic risks on a timely manner. Risk management and disclosure can help in meeting new and challenging regulatory requirements, improve organizational performance and enhance investors’ confidence (Duffy, 2014; Epstein & Buhovac, 2006).

Hassan (2009) defines risk disclosure as the following:

Financial statements’ inclusion of information about managers’ estimates, judgments, reliance on market-based accounting policies such as impairment, derivative hedging, financial instruments and fair value as well as the disclosure of concentrated operations, non-financial information about corporations’ plans, recruiting strategy and other operational, economic, political and financial risks. (p.669)

Duffy (2014, p.386) highlights that risk reporting can help in “… promoting informational efficiency in primary and secondary markets … achieving fairness and confidence in the markets … plausible reduction of opportunities for insider trading”. Specially, because of the notorious accounting scandals of Enron and Worldcom and the financial crisis of 2007-2009, the importance for corporate risk disclosure got huge attention (Probohudono, Tower, & Rusmin, 2013). That is why, the demand for risk reporting is growing (Epstein & Buhovac, 2006; Mokhtar & Mellett, 2013; Nahar et al., 2016a).

However, as the term ‘risk’ sounds to most of us as ‘bad news’, many companies remain reluctant to report on these issues irrespective of growing demand for risk disclosure. The report preparers think that such disclosure may have adverse effect on share price (Duffy, 2014). Though the supporters of risk reporting are coming up with the argument that such disclosure is crucial to better governance (ACCA, 2014), the preparers remain hesitant to produce this kind of report. Still now, in most of the economies, risk reporting practice is discretionary (Abraham & Shrives, 2014) and can be characterized as ‘boilerplate’, ‘too generic’/’non-specific’, ‘insufficient’, ‘not enough forward-looking’ and ‘unhelpful’ (ACCA, 2014; Abraham & Shrives, 2014). These reports do not really serve anyone’s interest (ACCA, 2014) and are meaningless (Abraham & Shrives, 2014). According to ACCA (2014), the preparers and the users are still negotiating on what to present in terms of corporate risk. Accounting researchers, over the years, have shown keen interest on this important yet problematic issue of risk disclosure.

The article is structured as follows. In the next section, the regulations related to risk reporting prevailing in different economies of the world are analyzed. After that, an overview of the relevant prior research is presented. The subsequent section summarises the theories which are used in different research to explain risk reporting practices. Finally, basing on all these discussions, research gaps are identified to be addressed by future researchers. These research gaps are the main contributions of this study.

2.2. Risk Reporting Regulations in Different Countries

The regulations on corporate risk disclosure around the world vary greatly in nature from merely discretionary to rigidly mandatory (see Figure 1). In this section, we have attempted to highlight the regulatory frameworks of risk reporting across different countries in the world:

Figure 1. Risk Reporting Regulation in Different Countries​​​​​​​

In the UK setting, risk reporting is voluntary where listed companies are encouraged to disclose business risk information in the Operating and Financial Review (OFR). Since 1997, Institute of Chartered Accountants in England and Wales (ICAEW) has been trying to guide and motivate the UK firms to voluntarily provide information about risk in annual reports. The Institute has published several discussion papers on risk reporting covering prospects and problems of risk reporting along with the guidance on how firms can report risk information in their annual report narratives (ICAEW, 1997, 1999, 2002, 2011).

In the United States, until 2005, companies were required to provide risk disclosures in registration statements for equity and debt offerings (Campbell, Chen, Dhaliwal, Lu, & Steele, 2014). Starting from 2005, the Securities and Exchange Commission (SEC) mandated listed firms to provide risk disclosures under “Item 1A-Risk Factor” section of form of 10-K (Wahlen, Baginski, & Bradshaw, 2014). The SEC’s Regulation S-K (Item 305c) provided under the Securities Exchange Act of 1934 requires companies to disclose “the most significant factors” that make a securities offering speculative or risky. As per the requirement of SEC, every listed company in the United States must file a comprehensive summary of a company's financial performance in the format prescribed in form 10-K. For a non-U.S. company that lists securities in the United States, a required format is “Form 20-F” which includes ‘‘Item 3DRisk Factors’’ for risk disclosures (Wahlen et al., 2014). The SEC requires that every listed company must disclose significant risk information in a concise, firm-specific and organized way rather than just disclosing risk factors which are generic in nature for all companies. However, according to an article published in CFO Magazine (August 2, 2010), SEC warned that current risk disclosures are “too broad, generic and repetitive” and urged the companies for more direct and specific risk information. In addition, the same article mentioned that SEC expressed strong desire to revise current regulation on risk reporting in the USA. Along with mandatory risk disclosures, Campbell et al. (2014) mentioned that some firms voluntarily provide risk information in Management Discussion & Analysis (MD&A) disclosure. Similar to the USA, in Canada, disclosure of financial and market risk and their management is regulated to a large extent (Dobler, Lajili, & Zéghal, 2011; Lajili & Zéghal, 2005). In contrast, nonfinancial types of risk are disclosed on a discretionary basis, to a large extent, mostly in the MD&A section under the condition of “materiality” and “significant risk exposure,” which might give management a chance to exercise their discretion in choosing to publicly disclose potentially relevant risk information (Lajili & Zéghal, 2005, p.129)

In Japan, according to Konishi and Ali (2007), the risk reporting regulation is still in its pre-mature stage. They attributed such situation to inherent reluctance of Japanese companies to maintain corporate secrecy. A little initiative was taken by Financial Service Agency (FSA) mandating all listed companies to disclose risk related information in their annual security reports starting from April 2003. Public companies in Japan must file annual securities reports (in Japanese) with the FSA. However such guidance lacks necessary directions regarding the content and structure of risk disclosures. Ali (2005) mentioned that Japanese companies have been voluntarily reporting risk information in their annual reports though the same is very unorganized and unsophisticated. In that sense, it is reasonable to consider that corporate risk reporting regulation in Japan is quasi-voluntary.

The European Union (EU) also attempted to guide companies whose securities are listed at a stock exchange within the EU regarding risk disclosures. In one of its directives (2004/109/EC), the EU requires all its listed companies to publish a management report which must include a description of principal risks and uncertainties that the company faces (Abraham & Cox, 2007). However, the directive failed to provide necessary details regarding the content and structure of risk disclosures. Risk reporting had been voluntary in the Italian institutional setting (Beretta & Bozzolan, 2008). However, following the European Union (EU) Transparency Directive (Directive 2004/109/EC) in order to harmonization of transparency in corporate disclosures among listed firms in the EU, a new requirement was added in the Civil Code of Italy in 2007 which forces firms to include a description of their risks and management responses in the MD&A section of their annual reports (Elshandidy & Neri, 2015). Similarly, in the Spanish context, in line with that directive issued by the EU, the Capital Firms Law (article no. 262) establishes the obligation of listed firms to disclose information on main risks and uncertainties in the management reports along with a description of management policies and procedures to cope with them (Domínguez & Gámez, 2014).

As a code law country, in Germany, German Accounting Standards Board (GASB) has published a comprehensive risk reporting standard (GAS 5) which requires companies to disclose information on all risk categories and risk management (Miihkinen, 2013). GAS 5 requires that all risk related disclosures should be made in a specific section (preferably under “Risk and Opportunities or Outlook”) of the annual report narrative (Elshandidy, Fraser, & Hussainey, 2015). Like Germany, in Finland risk reporting is highly regulated and guided. In 2006, Finnish Accounting Practice Board issued a detailed risk disclosure standard in order to develop best practices among companies in risk reporting. The standard is considered to be very unique in a sense that includes not only extensive guidance on expected risk reporting but also several illustrative disclosure examples (Miihkinen, 2012). Prior to this standard, though Finish Accounting Act requires the company to provide risk disclosures but requirements are very general and without implementation guidance (Miihkinen, 2013).

In the South African context, the first attempt to emphasis risk management and reporting was made by King Report (King II) in 2002. It provided explicit guidance on risk definition, identification, classification, governance and reporting (Ntim, Lindop, & Thomas, 2013). King II recommended that a company must assess risk and related control activities on an on-going basis and disclose in the annual report such risk management policies, contingency plan, internal control and reporting system along with a statement admitting the board’s responsibility for overall risk management and control (Ntim et al., 2013).

In the context of other developing countries, risk reporting is quasi-voluntary in nature due to very minimum as well as vague regulatory guidance regarding risk reporting. Moreover, regulatory enforcement is extremely fragile there due to poor or no monitoring mechanism. As for example, in Bangladesh, until 2012, there were no explicit guidelines for the listed companies to provide risk related information in the corporate disclosures (except disclosures in ‘corporate prospectus’ for IPO). Bangladesh Securities and Exchange Commision (BSEC) issued Corporate Governance Code (revised)-2012 which requires listed companies to disclose information on ‘Risk and Concern’ in the ‘Directors’ Report to Shareholders’ section of corporate annual reports. However, details guidelines are missing which could direct the company regarding the nature, extent, and format of risk disclosures. In Indian context, Securities and Exchange board of India (SEBI) issued Revised Clause 49 listing agreement to Indian stock exchange on 31^st Dec, 2005 which requires that company should also talk about risk as part of director’s report or Management discussion and analysis report under the head “Risk and Concerns” (Saggar & Singh, 2017).

3. Prior Research

Both theoretical/normative and empirical studies are available on corporate risk disclosure. Those studies are particularly focused on various issues like the significance of risk reporting, the current state (or the extent) of risk reporting in different industries across different economies, the determinants of risk reporting and the relation between risk reporting and corporate governance variables. In this section, we have summarised all those available studies (that were conducted mainly in the last two decades):

3.1. The Significance of Risk Disclosure

Investors consider risk disclosure very useful to deal with uncertainties (Amran et al., 2008; Duffy, 2014; Linsmeier, Thornton, Venkatachalam, & Welker, 2002). Epstein and Buhovac (2006) described the importance of corporate risk disclosure for managers in the following way:

Managers need good risk reporting systems to integrate risk evaluation into (a) their operational and capital investment decisions, (b) review of performance, and (c) compensation decisions. Improved organizational risk assessment and internal risk reporting is critical also for senior management and boards of directors, who are responsible for carefully establishing and reviewing corporate processes for identifying, assessing and managing risk. (p.6)

The same authors (Epstein & Buhovac, 2006) also highlighted the demand for risk disclosure from the stakeholders such as investors, regulators and financial analysts in order to make informed decision based on corporate performance. The report of ACCA (2014) also highlighted the similar benefits of risk disclosure. Based on interviews of various stakeholders (especially managers and analysts), the report emphasised that risk disclosure can enhance investors’ confidence on the quality of management. According to this report, institutional investors are emphasizing more on this kind of disclosures. Risk disclosure is especially important for the vulnerable industries such as financial sectors, pharmaceuticals and extraction industries (ACCA, 2014). Moreover, risk disclosure can help enhancing corporate reputation. Louhichi and Zreik (2015) examined whether risk disclosure have an effect on the reputation of the firm. They conducted content analysis of the annual reports of 68 firms. As a proxy of reputation, Fortune Magazine’s the Most Admired Companies list was used. It was found that risk disclosure affects the corporate reputation in a positive manner. The authors have drawn the conclusion with the help of legitimacy theory. According to them, disclosing risk information is a part of social contract. For that reason, if a company discloses more on risk, it will be rewarded with more reputation. Thus, risk reporting can be rewarding for the management.

In summary, according to the findings of prior studies it can be said that non-managerial stakeholders can have more protection and make better economic decisions by using risk disclosure. Also, management can go for better operational and investment decision making by assessing and reporting on risk. Moreover, investor confidence can be enhanced through risk reporting.

3.2. Current Practice, Problems and Prospects of Risk Disclosure

A good number of researchers also tried to explore the existing status of mandatory and voluntary risk disclosure practices by the companies. However, most common observation is that the current state is not satisfactory and the existing forms of risk disclosure fail fulfill the needs of the investors and other stakeholders (ACCA, 2014; Abraham & Shrives, 2014). The usefulness and quality of such disclosures are also questionable (ACCA, 2014; Abraham & Shrives, 2014).

In the study of Linsley and Shrives (2005), it was found that though the public companies of the UK are disclosing on risk, these are minimal and incomplete in nature. The companies are not providing quantitative information and the disclosure is mostly limited to generalized policy statements on risk. The study of Linsley et al. (2006) also had similar findings. The authors examined the risk disclosure practices of the UK and the Canadian banks. The authors mentioned that “the usefulness of current disclosure is questioned” (Linsley et al., 2006, p.268) as the disclosures were less quantitative and focused mainly on past issues rather than future risks. Another study that had similar findings is that of Lajili and Zeghal (2005). The authors conducted content analysis of the annual reports of TSE300 Canadian companies. The authors concluded that though the companies are focusing both on voluntary and mandatory risk disclosures, these disclosures are can be characterized by “lack of uniformity, clarity and quantification” (Lajili & Zeghal, 2005, p.125). They urged for more comprehensive disclosure. By examining 100 companies listed in the Tokyo Stock Exchange, Konishi and Ali (2007) found that companies are mostly providing descriptive risk disclosure. Companies, in general, are reluctant to quantify the risk related information.

The study of Linsley and Lawrence (2007) focuses on the readability of the risk disclosure in the annual reports of the UK companies. The authors applied Flesch Reading Ease formula in order to measure the readability. It was found that the readability level of risk disclosure is mostly ‘difficult’ or ‘very difficult’. The authors suggested that in order to enhance communication, the readability of these disclosures need to be improved. Deumes (2008) focused on the narrative risk reporting in the prospectus of the Dutch companies that were raising capital. The author conducted a content analysis of the texts of the prospectus and found that “a measure of risk extracted from these texts successfully predicts the volatility of companies’ future stock prices, the sensitivity of future stock prices to market-wide fluctuations, as well as severe declines in future stock prices” (Deumes, 2008, p.120).

The study of Dobler et al. (2011) is an inter-country comparison. The authors examined and compared the risk reporting practices in the US, Canadian, UK and German setting. In this study it was found that risk related disclosures are mostly presented in the management reports. Very little quantitative and forward-looking disclosures are presented in these reports. Among the companies of these countries, in terms of quantity of disclosure, US firms showed better performance. The authors attributed the variation in cross country disclosures to the domestic regulations prevailing in these countries. Berger’s (2012) study was based on the Indian companies in SENSEX. The findings of this study are also similar to the same of other studies. The author found that the companies are not disclosing quantitative information. Most of the disclosures are qualitative in nature. The author encouraged the regulatory bodies to come up with regulations that may help improving the information quality of the risk disclosures. Abraham and Shrives’ (2014) study concentrated on the risk disclosure of four companies in the food production and processing industry. The data was longitudinal and the authors applied both institutional and proprietary cost theories to draw the explanation of the findings. The study found that the disclosure is mostly ‘symbolic’ (rather than ‘substantive’) in nature. The authors suggested that a well monitored ‘comply or explain’ approach may help improving the situation.

While examining the risk reporting practices of the Spanish companies, Domínguez and Gámez (2014) found similar results. In their study it was found that the Spanish companies reveal less information related to risks and the reporting mainly highlights the “divulgation of the basic characteristics of the financial risks involved” (Domínguez & Gámez, 2014, p.116). According to the authors, the risk reporting of Spanish companies is highly superficial and conservative in nature lacking necessary detailing. The report of ACCA (2014) is mainly interview based and it highlights the current state, problems and prospects of risk reporting. Similar to Abraham and Shrives (2014), ACCA (2014) also mentioned that the current state of corporate risk disclosure is not satisfactory as these are mainly ‘boilerplate, generic’ kind of reports (ACCA, 2014, p.5). Organizations are highly reluctant to report on risk as discussion on potential risks may threaten the competitive advantage. According to the interviewees of this research, the current risk disclosure practice can be characterized as ‘too generic’, ‘too bland’, ‘too verbose’, ‘vague’, ‘formulaic’, ‘PR-oriented’ and ‘biased towards the positive’ (ACCA, 2014, pp. 9-10). As mentioned earlier, the main reason behind the reluctant attitude of the companies is that ‘risk’ itself is a negative notion. That is why, reporting on risk can be perceived as revealing the negative issues which may become counterproductive (ACCA, 2014). However, in this report, it was found that readers want more than what is currently reported. An “honest explanation in the context of the business strategy and the business model and the how risk is managed” is the necessity at this moment (ACCA, 2014, p.10). Another needed characteristic that was highlighted in this report is: brevity. It is important that a risk report should “contain more pictures than words, and should explain what matters to the company, what the company did right, what it did wrong, and what it changed” (ACCA, 2014, p.10). A balance between too much information and too little information is necessary. According to this report of ACCA (2014), guideline on risk reporting along with regulatory intervention is needed. Duffy (2014) also highlighted that risk disclosure can ensure investor protection. The author claimed that the continuously updating the risk disclosure is very important for market efficiency.

The study of Maffei, Aria, Fiondella, Spanò and Zagaria (2014) was based on the risk reporting practices of Italian banks. They assessed the reporting practices in the notes to financial statements and other public reports of 66 banks. The authors found that the Banks, in general, complied with the instructions of the Bank of Italy. It was found that the reporting practices of these banks are relatively uniform and the reporting in notes to financial statements is dense in nature. The study of Zadeh, Rashid, Basiruddin, Zamil and Vakilbashi (2016) was longitudinal and based on Malaysian listed companies. The authors conducted content analysis on the annual reports of 105 firms over the period 2001 to 2011. Like several previous studies, in this study it was also found that the level of disclosure is insufficient. The authors suggested that this practice needs to be rectified, and regulations and standards need to be set by following international accounting practices. In summary, according to the findings of these prior studies it can be said that, though the companies around the world are becoming aware of risk disclosure and reporting on risks, the contents of these disclosures are not satisfactory. Most of these reports are too generic and descriptive (not quantitative) and thus lack usefulness.

3.3. The Determinants of Risk Disclosure

The previous studies on risk reporting also focused on the determinants of risk disclosure. The study of Amran et al. (2008) focused on the Malaysian companies. The authors conducted content analysis of the annual reports of 100 Malaysian companies. The results were interpreted through stakeholder theory. The authors found that the extent of risk disclosure by Malaysian companies is low. In this study, the authors found that size has significant effect on corporate risk disclosure in Malaysia. Company size was also found as significant in the study of Linsley and Shrives (2005). This study was based on the UK public companies. In another study of Linsley and Shrives (2006) on the UK companies, the authors found that the risk disclosure has significant relationship with size and level of environmental risk.

Ali (2005) study on Japanese companies reveals similar facts. The author took annual reports of 90 non-financial companies in the Japanese Stock Exchange. As there was no regulatory guideline for risk reporting, it was found that Japanese companies were disclosing on risk related issues voluntarily. Corporate size was found to be the determinant of corporate risk disclosure. That means, larger companies disclosed on a larger extent. Abraham and Cox’s (2007) study was based on the narrative risk information in the annual reports of UK FTSE 100 companies. The relationship between the risk disclosure level and ownership, governance and US listing characteristics were examined. It was found that risk disclosure was negatively related to share ownership of long-term institutions. In terms of corporate governance, it was found that variables such as number of executives and number of independent directors are positively related to risk disclosure. It was also found that the pattern of risk information may depend upon the form of reporting regulation.

Konishi and Ali’s (2007) study focused on the determinants of risk disclosure of the Japanese companies. The authors took 100 companies listed in the Tokyo Stock Exchange as samples. Like several other similar studies, they also found that company size is positively related to risk disclosure. However, they did not find any relationship between the risk disclosure and other corporate characteristics. Deumes and Knechel (2008) investigated the incentives of the managers of the Netherlands for voluntary disclosure on risk management and control systems. The authors found a negative relation between the risk disclosure and management and block holder ownership. However, risk disclosure was positively related to financial leverage.

The study of Probohudono et al. (2013) was longitudinal and the authors conducted a cross country (Indonesia, Malaysia, Singapore and Australia) analysis. Like the study of Linsley and Shrives (2005), Ali (2005), Konishi and Ali (2007), and Amran et al. (2008), the authors of this study also found a significant positive relationship between size and risk disclosure. The other variable that was positively related to risk disclosure was board independence. However, it was found that leverage is significantly negatively associated with voluntary risk disclosure. Mokhtar and Mellett’s (2013), study was on Egyptian companies. The authors examined the extent of voluntary and mandatory risk disclosure of Egyptian companies. They also examined the impact of corporate governance, competition and ownership structure on risk disclosure. Like many other studies that investigated the extent of corporate risk disclosure, this study also finds a low level of risk disclosure. The authors found that companies are not even fulfilling the mandatory risk disclosure requirements. The extent of voluntary disclosure is also very low and these disclosures are mostly qualitative and not forward looking. The main determinants of risk disclosure are competition, role duality, ownership concentration, board size, and type of auditor.

Elshandidy, Fraser and Hussainey (2013) focused on the voluntary and mandatory risk reporting of the non-financial companies in the UK. The authors found that “firms of large size, high dividend-yield, high board independence, low (high) insider (outsider) ownership, and effective audit environments” go for more aggregate (voluntary and mandatory) risk disclosure (Elshandidy et al., 2013, p.1). Allini, Rossi and Hussainey (2016) examined the determinants of risk disclosure of the listed state-owned enterprises of Italy. It was found that company size, internet visibility, women’s presence in the board and age of board members have effect on risk disclosure. However, presence of directors with accounting/finance/business qualification was negatively related to risk disclosure.

Nahar, Azim, and Jubb’s (2016b) longitudinal study examined the determinants of risk disclosure in the annual reports (over 2007 to 2012) of Bangladeshi banks. The study was conducted from the perspective of five types/categories of financial institutions risk: market, credit, liquidity, operational and equity. It was found that the determinants of disclosure vary across these different categories of risk. The variables such as “the number of risk committees, leverage, company size, the existence of risk management unit, board size and a Big4 affiliate auditor” remained as “significant determinants of at least one category of risk disclosure” (Nahar et al., 2016b, p.426). In another study on Bangladeshi banks, Nahar et al. (2016a) examined the relationship among risk disclosure, cost of capital and bank performance. They found that cost of capital and risk disclosure are negatively related. Also there is an inverse relationship between risk disclosure and bank performance.

From this discussion it can be observed that company size remained as one of the main factors influencing risk disclosure. Thus, it was found in most of the studies that larger companies are reporting more on risk related issues. Most of the studies conducted are based on developed economies such as UK, Canada, Japan, Singapore and Australia. The reporting practices of the companies in developing economies such as Malaysia, Indonesia, Egypt and Bangladesh got highlighted by some of the authors. It can be said that, till now, little is known about the practices of underdeveloped and developing economies.

3.4. Risk Disclosure Framework

Few studies attempted to develop frameworks for risk disclosure. For instance, Beretta and Bozzolan (2004) proposed an index that can be helpful in measuring corporate risk disclosure quality. The authors applied this index on the non-financial companies in the Italian Stock Exchange. The authors highlighted that while analysing corporate risk communication it is important to focus both on ‘what’ is disclosed and ‘how’ it is disclosed. Cabedo and Tirado (2004) also proposed a quantification model for analysing different types of risks such as financial risks (market risks, credit risks, operational risks and liquidity risks) and non-financial risks (business risks and strategic risks).

3.5. Regulation and Risk Reporting

Some authors examined the impact of regulation on the corporate risk disclosure. Combes-Thuélin, Henneron and Touron (2006) analyzed different risk disclosure regulations from the context of the French companies. Through a qualitative analysis of the corporate annual reports, accounting standards, laws and other professional sources, the authors found no consensus between the different regulations and legislations. The authors mentioned that this lack of consensus in the laws create deficiencies in the reporting practices of the companies. Miihkinen (2012) investigated the impact of a national disclosure standard on the risk disclosure of the Finnish companies. The author found increase in the risk disclosure quantity. However, the author did not find an increase in the quantitative risk disclosure. Mainly larger firms and firms that disclosure under the requirements of the SEC went for more quantitative information. Therefore, the author commented that the impact of the standards on risk disclosure is not satisfactory.

4. Theories Applied in Different Studies

In the existing risk reporting literature, different strands of theories have been used to justify the incentives and/or disincentives of risk related disclosures. It is debatable which of these theories could better explain the disclosure or non-disclosure of risk related information. After reviewing relevant literature we find that there are two major streams of theoretical perspectives available justifying the current trends of risk reporting in the business firms. One stream of theories argues for the enhancement of risk related information in the corporate disclosures (e.g., Agency Theory, Stakeholder Theory, Legitimacy Theory, Uncertainty Reduction Theory, Political Cost Theory, ResourceDependency Theory, Signaling Theory). In contrast, a couple of theoretical perspectives urge for symbolic disclosure for the sake of minimum compliance with social or regulatory pressure (e.g., Institutional Theory) or rationalize the reasons behind corporate reluctance in reporting risk-related information (e.g., Proprietary Cost Theory). In this section, we have summarized those mostly applied perspectives in the literature in Table 2.

Table 2. Theoretical underpinning of Risk Reporting​​​​​​​

5. Research Gap and Avenues for Future Research

From the discussion it can be understood that the CRR has got immense importance from the researchers over the last two decades. The main reasons behind this attention are the notorious financial scandals at the beginning of 2000s and the credit crunch in 2007-2008. In these studies, the authors highlighted the issues such as the importance of corporate risk reporting, the current practice, problems and prospects of risk disclosure and the determinants of risk disclosure. After carefully review of previous studies, we have identified the following avenues for future research:

Firstly, it can be observed from the discussions above that most of the studies that were conducted on CRR are mainly representing the findings of developed economies such as the USA, Canada and the UK. Very few studies were based on the corporate sector of developing and underdeveloped economies. For that reason, little is known about the corporate risk disclosure practices of these economies. Researchers can consider this issue for their future research to take the literature further. This will help to get a broader picture of the risk reporting practices of the developing and underdeveloped economies.

Secondly, over the last two decades, engagement based research has become a popular method in corporate narrative studies [especially in the field of corporate social and environmental reporting. Please see Belal & Owen (2007), Deegan & Islam (2014), Islam & Deegan (2008), Momin (2013), Momin & Parker (2013)]. As per the findings of prior research, at this moment, risk reporting is mostly descriptive and lacks guidelines. For that reason, in many ways, the reporting is not consistent and the reporters remain reluctant to report. Through interviewing both managerial and non-managerial stakeholders, the researchers can get an in-depth view on the expectations of the management and the investors, motivations of management behind risk disclosure, problems and prospects of risk disclosure.

Thirdly, from the review and analysis of prior research it was found that the authors were mostly conducting quantitative content analysis of the corporate risk disclosure. These studies most highlight ‘whether’ anything was disclosed and if disclosed, ‘what’ was there. However, it was found in these studies that risk disclosure is mostly done in narrative form. That means, the presentation is not quantitative and ‘language’ is used to disclose these matters. That is why, rather than identifying only ‘what’ is disclosed, it is also important to highlight ‘how’ these issues are disclosed. A more meaning-oriented analysis is needed. Recently, in several studies on corporate narratives, the authors highlighted the importance of language based (or meaning-oriented) analysis (see Beelitz & Merkl-Davies, 2012; Craig & Brennan, 2012; Haji & Hossain, 2016; Higgins & Walker, 2012; Jonäll & Rimmel, 2010). Researchers can apply discourse analysis (a language based analysis) in their future research on CRR.

Fourthly, most of the prior studies mainly took a holistic approach (by taking companies from different sectors as samples) and did not go for in-depth analysis of any particular sector. Moreover, sectors other than banking (Linsley et al., 2006; Nahar et al., 2016a, 2016b; Oliveira et al., 2011a;) should get special attention from the researchers. According to the report of ACCA (2014), other than the companies in the financial sector, companies in pharmaceutical sector and extraction industries (such as fuel) are also highly exposed to risk. Future researchers may explore these areas.

Fifthly, most of the prior research has analyzed the risk disclosures in corporate annual reports only. However, over the years, corporate reporting has changed a lot. Now, other than the annual reports, companies all over the globe are also communicating with their stakeholders through corporate web sites, sustainability reports and integrated reports. Little is known about whether companies are communicating risk related issues through these reports. This can also be a future research agenda.

Sixthly, Prior studies on corporate risk disclosure also applied several theories. The theories that were applied in some of these studies include proprietary cost theory (Mokhtar & Mellett, 2013), agency theory (Mokhtar & Mellett, 2013; Nahar et al., 2016b), signalling theory (Mokhtar & Mellett, 2013), institutional theory (Abraham & Shrives, 2014), legitimacy theory (Oliveira et al., 2011a; Louhichi & Zreik, 2015) and stakeholder theory (Amran et al., 2008; Mokhtar & Mellett, 2013). Though those studies concentrated on descriptive corporate narratives, none of these made an attempt to look into the disclosures from an impression management perspective. Authors such as Brennan, Guillamon-Saorin and Pierce (2009) and Haji and Hossain (2016) encouraged analyzing corporate narratives from impression management perspective. Future researchers can analyse the phenomena from this angle.

6. Conclusion

In the last two decades, corporate risk disclosure became an important issue for the accounting researchers. Various studies on this topic were conducted and published around the globe. The main purpose of this study is to review the existing literature on CRR and identifying the research gap in order to highlight the possible avenues for future research. It is found that the existing literature mainly focused on issues such as the importance of risk reporting, the nature of reports, the problems and prospects of the reports and the determinants of corporate risk disclosure. Most of the studies are quantitative in nature. Moreover, the practices of the companies in the developed countries got more attention than those of developing and underdeveloped economies. By focusing on these main characteristics of the prior studies, several research gaps are highlighted in order to identify the avenues for future research. It is expected that if these dimensions are explored by the future researchers, a better and broader understanding of the risk reporting practices can be achieved.