Literature on risk disclosure has presented studies regarding the character of disclosure, some being focused only on the voluntary perspective (Barakat & Hussainey, 2013; Linsley & Shrives, 2006; Ntim, Lindop, & Thomas, 2013), while others focused on the perspective of mandatory character (Costa, Leal & Ponte, 2017; Filzen, 2015; Kravest & Muslu, 2013) and also, some pieces of research analyzed it thoroughly, i.e., voluntary and mandatory (Al-Hadi, Taylor & Al-Yahyaee, 2016; Elshandidy, Fraser & Hussainey, 2013; Elshandidy, Fraser & Hussainey, 2015).

As one of the factors which may explain the adoption of these information types, Elshandidy, Fraser, and Hussainey (2013) identified that companies with more exposure to risks tend to acknowledge a more significant amount of risk information, either voluntary- or mandatory-related. Furthermore, Elshandidy, Fraser and Hussainey (2015) analyzed British, German, and US companies to identify the occurrence and extent to which company and country characteristics influence voluntary and mandatory risk disclosures. The results indicate that variations in approaches to risk reporting stem from systematic risks, cultural values, and the country’s legal system.

In Brazil, to adjust the country’s rules with international standards, the Securities and Exchange Commission [CVM], in its Normative Instruction CVM No. 480/2009, established the Reference Form, which is a model for disclosure of quantitative and qualitative information (Klann, Kreuzberg, & Beck, 2014). This Instruction requires the practices and policies declaration of the most fragile aspects of the corporation, including information on risks (CVM, 2009). As a result, the description of risk factors related to the company’s activities is one of the points requested in the Reference Form. All aspects of the risk that may impact the stakeholders’ decision-making should be presented (Klann, Kreuzberg, & Beck, 2014).

In addition, Technical Pronouncement CPC 40 (R1), from June 1st, 2012, which accounts for disclosing financial instruments, reinforced the requirement of risk disclosure. In this document, Brazilian companies are subject to disclose quantitative and qualitative information about the risks to which they are exposed due to financial instruments and how these risks are managed (CPC, 2012). However, Brazilian publicly held corporations have the discretion to disclose information on risks. Although there is a specific section for the disclosure of risk factors in the Reference Form - section 4, companies can choose what and how to carry out this procedure, characterized, therefore, as voluntary disclosure. In conclusion, according to Clemente, Ribeiro, Silva and Oliveira (2019), companies seek to disclose information that is aligned with stakeholders’ perspectives.

Moreover, the studies developed to pay attention to the category of risks researched, which may be financial and, or non-financial. In this sense, the financial risks are related to the companies’ assets and liabilities (Amaral & Lemos, 2015) and the non-financial risks refer to other situations and circumstances that happen or may happen in companies, whether internal or not (Amaral & Lemos, 2015). Regarding the category of risks, there are works, like the present research, that focus on the analysis of disclosure of non-financial risks, such as that of Harper Ho (2018), who investigated the disclosure of non-financial risks and its relationship with private ordering costs, and that of Barakat and Hussainey (2013), who researched governance, regulation, supervision, and the disclosures of operational risks in European banks. Amaral and Lemos (2015), in turn, investigated the determinants of the level of financial risk disclosure in financial firms in Portugal. There are also works that set to address financial and non-financial risks, such as Linsley and Shrives (2006) and Miihkinen (2012).

The research considers, for risk-disclosure analysis, the combination of the subcategories of non-financial risks proposed in the studies of Linsley and Shrives (2006), operational, empowerment, information processing and technology, integrity, and strategic risks; Miihkinen (2012), strategic, operational, damage and management risks; and Ntim, Lindop, and Thomas (2013), operational/business and strategic.

The Operational Risks subcategory deals with internal processes, people or systems, and external events that have a loss effect on business (Coleman, 2011). Damage Risks, as pointed out by Miihkinen (2012), deal with losses caused by lawsuits and insufficient insurance coverage. Integrity Risks refer to the loss of the company’s integrity, through fraud and illegal acts, for example (Linsley & Shrives, 2006). Whereas strategic risks refer to external events or conditions that may affect the company’s decision-making within its operations (Kamaruzaman, Ghani, & Gunardi, 2019).

Research on corporate reputation has focused on three types of approaches: reputation as an asset, which is considered intangible and strategic within companies (Delgado-Garcia, Quevedo-Puente, & Díez-Esteban, 2013); as an evaluation, that is, arising from the moral assessment of stakeholders; and as a perception, indicating that it originates from stakeholders’ views, especially its customers (Barnett, Jermier, & Lafferty, 2006). In this study, corporate reputation is considered from the asset approach.

Evidence shows that corporate reputation is considered by some managers as one of the main intangible company assets (Barnett, Jermier, & Lafferty, 2006; Chun, 2005). From the literature, it can be said that the relationship between stakeholders and organizations is facilitated (Makarius, Stevens, & Tenhiälä, 2017). Therefore, it is associated with several strategic advantages, such as sustainable competitive benefits (Delgado-García, Quevedo-Puente, & Díez-Esteban, 2013), financial performance, higher margins, and prices (Walker, 2010), and increased cash flows (Robinson, Kleffner, & Bertels, 2011).

In this context, corporate reputation management is essential and can be strategically used through information disclosure so that companies with reputations seek to provide greater corporate transparency (Cardoso, De Luca, & Gallon, 2014). This is because stakeholders tend to prefer companies with a good reputation (Fombrun & Shanley, 1990), mainly because of their behaviors, such as product or service quality and transparency (Dowling, 1986).

From the perspective of risk disclosure, Bravo (2017), researching companies listed in the Standard & Poor’s 500 Index for 2009, pointed out that corporate reputation mediates the relationship between risk disclosure and company value.

It is observed that in research conducted on corporate reputation and disclosure, some theories are employed, such as signaling (Freitas, Kobal, De Luca, & Vasconcelos, 2013), disclosure, or voluntary disclosure (Rover, Borba, & Murcia, 2009), and legitimacy (Conceição, Dourado, Baqueiro, Freire, & Brito 2011). The latter is the focus of this study, considering that, according to the legitimacy theory, from the disclosure of information, firms can achieve, maintain, or regain their legitimate status before society (Beuren, Gubiani, & Soares, 2013).

According to Aldaz, Alvarez, and Calvo (2015), disclosing information can help legitimize companies with worse performance. It is noteworthy that the legitimacy theory recognizes a contractual relationship between society and companies so that organizational activities seek to be aligned with the demands presented by these stakeholders, which leads them to achieve or maintain legitimacy (Dias Filho, 2013). Therefore, firms use strategies that help build and maintain legitimacy to be accepted in society and can continue consuming the resources necessary for their activities (Lieges, Zanchet, & Gomes, 2018).

The alignment with the legitimacy theory develops from the behavior and actions of companies performed to achieve acceptability before society (Lopes et al., 2017). This theory highlights the meeting of needs of various stakeholders through criteria that these parties consider acceptable and that have been constructed and legitimized socially, hence, allowing the establishment or maintenance of reputation (Fombrun & Shanley, 1990).

The study of corporate reputation and risk disclosure, individually, has been widely developed, both internationally and nationally, but the relationship between them has been little explored. In this research, we suggest that there is a relationship between these two constructs since reputation can be a determining factor for the reporting of risks in corporate, institutional reports.

Kim and Yasuda (2018) point out that discretionary disclosure of corporate risk information is a challenge for investigation because it is the evidence of textual nature and unfavorable aspects. Solomon et al. (2000) point out that risk disclosure includes all types of risks that encompass a business, so the information should influence the decision-making of current or potential investors.

The very definition of risk directs to the idea of adverse conditions for organizations, as stated by Linsley and Shrives (2006). Moumen, Othman, and Hussainey (2015) highlight that, despite the increased number of studies, risk disclosure is still an ambiguous area in organizational disclosure. This fact occurs because, in general, even though regulation exists, companies avoid reporting on risks to diminish the unfavorable aspects of the business (Almendra et al., 2018; Polinsky & Shavell, 2012).

It is, therefore, noteworthy that stakeholders tend to be risk-averse; once, the alternative of two companies that present similarities in financial performance, the best reputation will be analyzed (Brammer & Millington, 2005; Fombrun & Shanley, 1990). In line with this proposition, Fombrun (2001) considers that the corporate reputation ranking impacts the companies’ shares, either by the more terrific attractiveness to investors or by the decrease in stock value.

Eckert (2017), in his research, which focused on reputation risks, highlights that in addition to having an excellent corporate reputation, it is essential that risks be managed. Srivastava, McInish, Wood, and Capraro (1997), when investigated the relationship between reputation and systematic risk, found that the level of company reputation influences the acceptance of risk by investors, i.e., for companies with a higher reputation, there are more investors inclined to accept risks.

The study of Delgado-García, Quevedo-Puente, and Díez- Esteban (2013) in Spanish publicly traded companies, sought to analyze the effects of corporate reputation on systematic, non-systematic, and total risk. The study results determined that the company is respectable. In other words, having a corporate reputation reduces the unsystematic and total risk of the company; however, it increases the systematic risk. Furthermore, it was found that when it comes to risk, the critical aspect is not the corporate reputation level of the companies but whether they are reputable or not.

Similarly, Bakhsh, Akhtar and Akhtar (2019) on companies listed on the Pakistan Stock Exchange investigated the impact of reputation on risk exposure from 2007 to 2016. The results showed a negative relationship between reputation and the company’s total, and systematic risks, while no significance was found with unsystematic risks.

Lopes et al. (2017) evidenced that corporate reputation can be seen to highlight the behavior of companies. Moreover, Bravo (2017) points out that reputation has an effect related to risk disclosure. From a similar perspective to this research, studies also show that companies with higher visibility present more disclosures (Aldaz, Alvarez, & Calvo, 2015; Cardoso, De Luca, & Gallon, 2014; Cruz & Lima, 2010), including on risks (Delgado-García, Quevedo-Puente, & Díez-Esteban, 2013; Oliveira, Rodrigues, & Craig, 2011).

Consequently, based on the legitimacy theory and the theoretical-empirical contributions presented; the following research hypothesis was formulated:

H1: Non-financial risk disclosure is associated with the existence of corporate reputation.

To meet the first specific objective, verification was performed on the risk factors employing the Regression Tree (CRT). This way, the Regression Tree model of the dependent variable DR (non-financial risk disclosure) as a function of the individual risk factors analyzed (Figure 1) is presented in Figure 3.

Since the CRT method is developed to maximize homogeneity within nodes, the extent to which a node does not represent a homogeneous set of cases is an indicator of impurity (Pedro, Ferreira, & Mendes, 2010). Thus, the impurity measure used was the LSD (least-squared deviation). In the construction of the tree, the LSD only creates partitions in which the difference between the variance of the ascending node and the sum of the variances of the two descending nodes (weighted by the proportion of cases in each node) is more significant than a defined value, and the value 0.0001 was chosen.

The pruning technique was applied to reduce the complexity of the tree without jeopardizing the quality of adjustment and to avoid the problem of overfitting, that is, to avoid overfitting to the modeling sample, which cannot be generalized to other samples. The quality of the fit of the models was evaluated through the estimated risk that represents the variance within nodes, which is the part of the total variance not explained by the model. The lower the estimated risk, the better the model. The model validation, which allows verifying to what extent the adjusted tree structure can be generalized to other observations, was done using half of the sample as a modeling sample and the other half as a validation sample (Pedro, Ferreira, & Mendes, 2010).

It can be seen from Figure 3 that the companies with the highest DR (disclosure of non-financial risks) are found in node 22 with a mean of 48.600 and standard deviation of 6.883, being those that presented: Factor 2.4.8 - Risk of occurrence of natural disasters affecting the business environment above 1.5; Factor 2. 4.9 - Risk of loss of control over suppliers and, or risk of dependence on suppliers below 2.5; Factor 2.3.3 - Risk of ethical problems and corruption in business above 1.5; and Factor 2.3.2 - Risk of negative impact on the company’s reputation or image above 1.5.

Figure 3
Tree regression
Source: Research data.

In the opposite direction, we find in the fifteenth node the companies with the lowest DR (disclosure of non-financial risks), with a mean of 19.900 and standard deviation of 7.254, being those that presented: Factor 2.4.4 - Risk of regulatory changes lower or equal to 1.5; Factor 2. 4.6 - Risk of economic changes less than or equal to 1.5; Factor 2.3.1 - Risk of internal or external fraudulent actions less than or equal to 0.5; and Factor 2.3.2 - Risk of negative impact on the company’s reputation or image less than or equal to 1.5.

The estimated risk for the modeling sample was 27.075, with a standard error of 2.410. For the validation sample, an estimated risk of 40.386 was obtained with a standard error of 3.099. The values obtained for the estimated risk in the two samples indicate that no overfitting occurred, with the estimated risk being higher in the validation sample.

The main characteristics of the terminal nodes of the regression tree fitted to the modeling sample are shown in Table 1, which indicates to which terminal node a new individual will belong, and the respective non-financial risk disclosure can be estimated by the average of that node.

Table 1
Drivers of non-financial risk disclosure (DR)

Source: Research data.

It is worth mentioning that the risk factors corresponding to the subcategory Integrity were those that presented the highest importance in the model: Factor 2.3.3 Risk of ethical problems and corruption in business (47,267); and Factor 2.3.2 Risk of negative impact on the company’s reputation or image (39,652). Factor 2.3.1 Risk of internal or external fraudulent actions, in turn, was the eighth most crucial variable for the model (30.203).

This finding indicates that risks related to losses caused by fraud and illegal acts, for instance, can directly impact risk disclosure. At this point, the proximity of the factors in the integrity risk subcategory to corporate reputation stands out. During the analyses of the Reference Forms, the existence of anti-corruption operations unfavorable to some companies was observed, as is the case of the “Weak Meat” operation.

To achieve the research’s second specific objective, the Multiple Correspondence Analysis (MCA) was used, and the Chi-square test was initially performed. It is worth mentioning that to perform MCA, the quartile-based risk disclosure level was used. By doing so, the following values were established for the non-financial risk disclosure category (General) through the four levels: Very Low (up to 29 points), Low (29.1 to 35), High (35.1 to 43), and Very High (above 43). Considering these levels, Figure 4 shows the perceptual map with the results of the association analysis between the general level of non-financial risk disclosure, corporate reputation, and the sector in which companies operate.

Figure 4
Perceptual map of multiple correspondences between the overall level of non-financial risk disclosure, corporate reputation, and industry sector
Source: Research data.

From the proximities shown in Figure 4, it can be inferred that companies classified without corporate reputation presented low and very low levels of non-financial risk disclosure, with more significant presence in the Public Utility and Cyclical Consumption sectors. On the other hand, regarding companies with corporate reputation, these are associated with the sectors of Industrial Goods, Basic Materials, Finance, and Communications but are not close to any of the specifically established risk disclosure levels.

This finding aligns with studies that indicate corporate reputation as a preponderant factor for greater corporate transparency since one observes the absence of reputation and lower levels of non-financial risk disclosure. Oliveira, Rodrigues and Craig (2011) pointed out that companies with higher visibility have higher disclosure levels. Starks (2009) argued that firms’ reputation impacts their risks. Furthermore, Gunawan and Elsa (2020) stated that companies with reputations show financial and non-financial information about risks in their reports. However, it is noted that in the Brazilian companies investigated. It was not possible to find an association between a high or very high level of non-financial risk disclosure and the existence of reputation. The association between the three organizational aspects was only evident in the group without a corporate reputation.

In a complementary manner, for improved understanding of the association between the constructs studied, new analyses were conducted regarding the specific relationship between the level of disclosure of non-financial risks through its four subcategories (operational, damage, integrity and strategic), reputation and the sector in which companies operate. As in the general category (Figure 4), quartiles were also adopted for the subcategories to classify disclosure levels into Very Low, Low, High, and Very High. The results found are briefly described below.

From the disclosure of information of the subcategory operational risks, it was observed that companies without reputation in the Cyclical Consumption and Healthcare sectors presented a low level of disclosure, and companies in the Utility sector presented a high level of operational risk disclosure. On the other hand, companies with a corporate reputation in the Basic Materials and Industrial Goods sectors showed no relationship with operational risk disclosure levels. This result by the operational risk subcategory reinforces the finding of the association of public non-financial risk disclosure (Figure 4), in which it cannot be said that companies with corporate reputations are associated with higher levels of risk disclosure.

As for the association between the disclosure level of the damage risk subcategory, corporate reputation, and sector, proximity between companies without reputation was noticed alongside the disclosure of damage risks of Low level and the cyclical consumption sector, and high level in the Public Utilities sector. However, it is identified that companies with reputation, operating in the Industrial Goods, Non-Cyclical Consumption, and financial sectors are associated with a very low level of damage risk disclosure.

This result indicates that companies in the Utilities sector, which are related to services such as electric power, water and sanitation, and gas, present a higher level of disclosure related to the risk of lawsuits and insufficient insurance coverage, which are, according to Miihkinen (2012), covered by damage risks. This is an indication of the vulnerability of these companies to the occurrence of events for which there is no or insufficient insurance, as well as for lawsuits motivated by various factors such as lack of energy, water, or gas. To corroborate this proposition, we observe the report of the company Comgás, a participant in the gas segment, with respect to damage risks, insufficient insurance coverage factor in its 2018 Reference Form, page 4:

Liabilities arising from such interruptions or disturbances that are not covered by the Company’s insurance policies or that exceed the limits of coverage may result in significant additional costs, which could have a material adverse effect on the Company’s financial condition and results of operations. (...) The Company’s insurance policies may not be sufficient to fully cover liabilities that may be attributable to the Company in the ordinary course of business. (...) The Company’s results of operations may be adversely affected by the occurrence of accidents resulting in damages for which the Company is not fully covered under its existing insurance policies.

Given that, the analysis of the association between the level of disclosure of the integrity risk subcategory, corporate reputation and industry sector revealed that companies with a good reputation in the non-cyclical consumption sector had a very high level of integrity risk disclosure. On the other hand, companies without reputation in the Public Utilities sector had a very low level of disclosure on integrity risk information.

It is noteworthy that the Non-Cyclical Consumption sector, associated with the group of companies with corporate reputation and a very high level of disclosure, deals with essential products or services that are independent of economic cycles. According to Linsley and Shrives (2006), integrity risks are related to aspects such as fraud and ethical problems, i.e., events that can impact the integrity of companies. Therefore, it was found that companies with a reputation in this sector are more interested in performing these disclosures, which may be related to episodes of fraud that have already occurred in the sector, such as Operation “Weak Meat”. To demonstrate this relationship, we present an excerpt reported by the company BRF in its 2017 Reference Form, page 30:

(...) The Company has a framework of anti-fraud initiatives, including anti-bribery and anti-corruption, that supports all business segments and business patterns worldwide. However, the Company is not able to fully mitigate all fraud risks. Possible violations of anti-corruption laws have been identified from time to time as part of BRF’s compliance and internal control processes. In addition, the Company was recently notified of allegations involving possible misconduct by some of its employees in connection with “Operação Carne Fraca”.

In sequence, the analysis of the association between the level of disclosure of the subcategory strategic risks, corporate reputation and the sector of the companies revealed that companies with no reputation in the Healthcare sector presented a low level of disclosure of strategic risks, while companies with a reputation in the Industrial Goods, Financial and Non-cyclical Consumer Goods sectors present a very high level of disclosure of strategic risks. Thus, it can be inferred that the companies without corporate reputation that were analyzed did not tend to disclose their strategic risks and those that still do so with fewer details.

In summary, it was found, based on the MCA and chi-square tests, that there is no clear association between companies with corporate reputation, the general level of non-financial risk disclosure and the sector of the companies. However, the associations between the level of non-financial risk disclosure in the subcategories of integrity and strategic risks, the sector and the existence of corporate reputation were significant.

To achieve the third specific objective of comparatively examining the disclosure of non-financial risks between companies classified with and without corporate reputation, the T-test was performed, whose results are shown in Table 2.

Table 2
Behavior of non-financial risk disclosure (general and by subcategory) in companies classified with and without corporate reputation

Note: (*): significant to 0,001; (**): significant to 0,05; (***) significant to 0,10. Source: Research data.

The results of the independent t-test showed that the variables non-financial risk disclosure (general), operational risk disclosure, integrity risk disclosure and strategic risk disclosure behave differently when comparing companies with and without corporate reputation. Specifically, it can be statistically verified that (i) firms with reputation exhibit higher overall level of non-financial risk disclosure than firms without reputation (t(345)=3.406; p<0.05); (ii) firms with reputation exhibit higher disclosure of the integrity risks subcategory than firms without corporate reputation (t(345)= 1.801; p<0.10); and (iii) firms with reputation exhibit higher disclosure of the strategic risks subcategory than firms without corporate reputation (t(345)= 1.867; p<0.01).

Therefore, the results presented in Table 2 indicate that companies classified as having a reputation present a better overall level of disclosure of non-financial risks in relation to companies classified as having no reputation, a fact that is in line with the assumptions of the legitimacy theory. This finding is also confirmed for the disclosure of information on integrity and strategic risks. These results can be understood from Fobrum’s (2001) recommendations that having a corporate reputation affects a company’s actions. Complementarily, Delgado-García, Quevedo-Puente and Díez- Esteban (2013) and Oliveira, Rodrigues and Craig (2011) pointed out that companies that have greater visibility present greater disclosure on risks.