The U.S. Securities and Exchange Commission is putting legal departments on alert that when they disclose something as a "risk factor" in regulatory filings, they need to have internal controls in place monitoring it.