How to Fill Out SEC Form 10-K (w/Examples) + FAQs

You fill out SEC Form 10-K by completing four parts and sixteen items that disclose your company’s business, risks, audited financial statements, and management’s discussion, then filing it on EDGAR using inline XBRL within 60, 75, or 90 days of fiscal year-end depending on your filer status. The form is mandated by Section 13(a) of the Securities Exchange Act of 1934 and is governed by the line-item rules in Regulation S-K and the financial statement rules in Regulation S-X.

A late or defective 10-K can trigger a Section 12(j) deregistration proceeding, exchange delisting, and private securities litigation under Rule 10b-5. The SEC reported that roughly 7,000 public companies file annual reports each year, and in fiscal 2024 the SEC brought 583 enforcement actions, many tied to flawed periodic reporting under the Division of Enforcement annual report.

• 📑 How to complete every Item 1 through Item 16 line by line on Form 10-K
• ⏱️ Exact filing deadlines for large accelerated, accelerated, non-accelerated, and smaller reporting filers
• 🛡️ How to draft Item 1A risk factors, Item 1C cybersecurity, and Item 7 MD&A without triggering enforcement
• 🧾 How Sarbanes-Oxley Section 302 and 404 certifications and PCAOB AS 3101 auditor reports must be attached
• ⚖️ Real enforcement cases like SolarWinds, Hertz, and the BF Borgers shutdown and how to avoid the same mistakes

What Form 10-K Is and Why It Exists

Form 10-K is the comprehensive annual report that every U.S. public company files with the Securities and Exchange Commission under Section 13(a) and Section 15(d) of the Securities Exchange Act of 1934. The form lives at the heart of the federal disclosure system, and the SEC publishes the official template in the Form 10-K General Instructions. Congress created this filing after the 1929 crash to give investors a single, audited, standardized document to evaluate a company once a year.

The form exists because Congress decided in 1934 that secondary-market trading needs continuous disclosure, not just the one-time prospectus disclosure required by the Securities Act of 1933. The consequence of skipping a 10-K is severe, since the SEC can suspend or revoke the registration of a delinquent filer under Exchange Act Section 12(j). A real example is the SEC’s 2022 sweep that deregistered dozens of shell companies for failing to file 10-Ks for three or more years.

A common misconception is that a 10-K is the same as the glossy annual report mailed to shareholders. The glossy book is a marketing piece governed by Rule 14a-3 under the proxy rules, while the 10-K is the legal filing that controls liability under Rule 10b-5. Many companies wrap the 10-K inside the glossy book, but the 10-K text itself must follow the SEC’s line-item rules exactly.

Who Must File a 10-K

Any company with a class of securities registered under Section 12 of the Exchange Act, or that has filed a registration statement under the 1933 Act that has gone effective, must file a 10-K. The SEC’s Financial Reporting Manual explains how the filing duty attaches the moment the registration statement is declared effective. Foreign private issuers file Form 20-F instead, and Canadian issuers may use Form 40-F under the multijurisdictional disclosure system.

The consequence of misclassifying yourself is that you file the wrong form and create a material misstatement by omission. For example, in 2019 the SEC charged a Cayman issuer that incorrectly filed 10-Ks instead of 20-Fs, leading to civil penalties and an officer-and-director bar. A common misconception is that small private companies with few shareholders never file, but Section 15(d) pulls in any company that has done a public offering, even if its shares no longer trade on an exchange.

The Four Filer Tiers

The SEC defines four filer tiers in Rule 12b-2, and each tier gets its own deadline and scaled disclosure rules. Large accelerated filers have a worldwide public float of $700 million or more and file within 60 days of fiscal year-end. Accelerated filers have a float between $75 million and $700 million and file within 75 days, while non-accelerated filers and smaller reporting companies (under $250 million float, or under $100 million revenue with under $700 million float) file within 90 days.

The consequence of misjudging your tier is that you miss the deadline, lose Form S-3 shelf eligibility for 12 months, and trigger an exchange listing review. A real example is when General Electric reclassified as an accelerated filer in 2018 after spinning off pieces, and its disclosure committee had to retrain on the tighter 75-day clock. Emerging growth companies under the JOBS Act get extra relief, including a five-year delay on auditor attestation of internal controls under Section 404(b).

Form 10-K’s Four Parts and Sixteen Items

Form 10-K has four parts and sixteen numbered items, plus a signature block and exhibit index. Part I covers the business and risks, Part II covers financials and MD&A, Part III covers governance and executive compensation, and Part IV covers exhibits and a 10-K summary. The structure is fixed by the Form 10-K General Instructions, and you cannot reorder the items.

The consequence of skipping or burying an item is a Rule 12b-20 violation, which forbids omitting any material information needed to make the required statements not misleading. A common misconception is that Part III can be left blank if you incorporate by reference from your proxy statement, but the proxy must actually be filed within 120 days of fiscal year-end or you must amend the 10-K with a Form 10-K/A. For example, in 2024 a Nasdaq-listed biotech missed the 120-day window and had to file a 10-K/A within days to avoid a Nasdaq delisting letter.

Part I — Items 1 Through 4

Part I tells the investor what the company does and what could go wrong. Item 1 (Business) follows Item 101 of Regulation S-K and requires a narrative on segments, customers, suppliers, human capital, intellectual property, and government regulation. Item 1A (Risk Factors) is governed by Item 105 and must list specific, tailored risks, not generic boilerplate.

Item 1B (Unresolved Staff Comments) only applies to accelerated and large accelerated filers and lists any SEC comment letters outstanding for more than 180 days. Item 1C (Cybersecurity) was added by the SEC’s 2023 cybersecurity rule and requires disclosure of risk-management processes, board oversight, and management expertise. Item 2 (Properties), Item 3 (Legal Proceedings under Item 103), and Item 4 (Mine Safety Disclosures under Dodd-Frank Section 1503) round out Part I.

The consequence of weak Item 1A drafting is that a court will find the risk warning inadequate and refuse to dismiss a Rule 10b-5 case. A real example is In re Facebook Securities Litigation, where the Ninth Circuit held that warning about a hypothetical risk that had already materialized was itself misleading. Maria, the new general counsel of a Delaware fintech, learned this when her team copied last year’s Item 1A and forgot to update a risk that had become an actual SEC investigation.

Part II — Items 5 Through 9C

Part II is the financial heart of the 10-K. Item 5 covers the market for common equity, dividends, and share repurchases under Item 201 and Item 703. Item 6 was once Selected Financial Data but is now reserved after the SEC’s 2020 modernization rule, which let companies drop the five-year table.

Item 7 is Management’s Discussion and Analysis under Item 303, which the staff calls “the most important narrative in the filing.” Item 7A (Quantitative and Qualitative Disclosures About Market Risk) under Item 305 walks through interest, currency, and commodity exposures. Item 8 contains the audited financial statements prepared under Regulation S-X, Item 9 covers changes in or disagreements with accountants, Item 9A covers Sarbanes-Oxley Section 404 internal controls, Item 9B covers other information, and Item 9C addresses foreign jurisdictions that prevent inspections under the Holding Foreign Companies Accountable Act.

The consequence of a defective MD&A is severe. The SEC’s Caterpillar enforcement action and the more recent Hertz settlement show that hiding a known trend in MD&A is a stand-alone fraud charge under Section 13(a). A common misconception is that MD&A only needs to repeat the income statement, but Item 303(b)(2) requires forward-looking discussion of known trends, demands, commitments, events, and uncertainties.

Part III — Items 10 Through 14

Part III covers governance topics that most filers incorporate by reference from the proxy statement under General Instruction G(3). Item 10 (Directors, Executive Officers and Corporate Governance) follows Item 401, Item 405, and Item 406 on the code of ethics. Item 11 (Executive Compensation) follows Item 402, including the Compensation Discussion and Analysis, Summary Compensation Table, and the new pay-versus-performance table required by Item 402(v).

Item 12 covers security ownership of beneficial owners and management plus equity compensation plan information. Item 13 covers related-party transactions and director independence under Item 404, and Item 14 covers principal accountant fees and services under Item 9(e) of Schedule 14A. New rules added Item 408(b), which requires you to file your insider trading policy as Exhibit 19 and your clawback policy as Exhibit 97.

The consequence of incorrect Part III disclosure is personal exposure for the named officers and directors under Section 16 and Section 304 of Sarbanes-Oxley, which can claw back bonuses. James, the CFO of a mid-cap industrial, learned this in 2024 when the SEC required him to forfeit two years of incentive pay after his company restated earnings. A common misconception is that Item 14 audit fees are just a footnote, but the audit committee must pre-approve every fee under Section 10A(i) of the Exchange Act.

Part IV — Items 15 and 16

Part IV is short but critical because it lists every exhibit. Item 15 (Exhibit and Financial Statement Schedules) ties to Item 601 of Regulation S-K and lists material contracts, subsidiaries (Exhibit 21), consents (Exhibit 23), Section 302 certifications (Exhibit 31), Section 906 certifications (Exhibit 32), insider trading policy (Exhibit 19), and clawback policy (Exhibit 97). Item 16 is the optional 10-K Summary, which almost no filers use.

The consequence of forgetting an exhibit, especially the Section 302 certifications signed by both the CEO and CFO, is that the entire 10-K is treated as defective. The SEC’s 2009 case In the Matter of Roy M. Speer and many later actions show that an unsigned or missing certification draws a stand-alone fraud charge. For example, in 2022 a small-cap energy company had to refile its 10-K within 48 hours after the staff noticed a missing Exhibit 31.2.

Step-by-Step Filing Process

You file Form 10-K through EDGAR using your CIK and CCC codes, and you must tag every financial statement with inline XBRL under the SEC’s iXBRL rule. The process moves from drafting to internal certification to auditor sign-off to EDGAR submission. Each step has its own deadline and consequence if missed.

Begin with a disclosure-committee kickoff at least 90 days before fiscal year-end and circulate a drafting calendar based on the SEC’s Financial Reporting Manual. Auditors complete fieldwork and issue the PCAOB AS 3101 auditor’s report with critical audit matters. The CEO and CFO sign Section 302 and Section 906 certifications, the audit committee approves filing, and you submit through EDGAR before 5:30 p.m. Eastern on the deadline day.

The consequence of a missed deadline is that you must file Form 12b-25 (NT 10-K) before the original deadline to claim a 15-day extension under Rule 12b-25. If you do not cure within 15 calendar days, you become a delinquent filer, lose Form S-3 eligibility, and face exchange notice. A common misconception is that an NT 10-K is “automatic,” but you must certify in good faith that the delay could not be eliminated without unreasonable effort or expense.

Drafting and Internal Review

Drafting starts with a disclosure controls memo and a working group that includes legal, finance, IR, IT for cyber, and HR for human capital. Each section owner pulls from prior filings, board minutes, and the SEC staff’s Compliance and Disclosure Interpretations. The disclosure committee meets at least twice before filing to mark up drafts and challenge management on known trends.

The consequence of skipping disclosure controls is a Section 302 violation, since the CEO and CFO certify they have designed and evaluated those controls. A real example is the 2024 SEC action against a SaaS issuer whose CEO certified DCP effectiveness despite knowing the IT general controls were broken. Priya, the assistant general counsel of a small-cap medtech, fixed this by adding a quarterly sub-certification process where each business unit lead signs off in writing.

Auditor Sign-Off and PCAOB AS 3101

Your independent registered public accounting firm must be registered with the PCAOB and must issue an auditor’s report under AS 3101 that includes Critical Audit Matters. For accelerated and large accelerated filers that are not emerging growth companies, the auditor also issues a separate attestation on internal control over financial reporting under AS 2201 and Section 404(b).

The consequence of using an unregistered or sanctioned auditor is catastrophic. In May 2024 the SEC charged BF Borgers and its owner with massive fraud and ordered the firm to stop auditing public companies, leaving more than 1,500 clients scrambling to refile or restate. A common misconception is that a Big Four name automatically protects the filing, but PwC’s 2019 settlement for independence violations shows that even tier-one firms can fall short.

EDGAR Submission and iXBRL

You submit on EDGAR using a Form Type 10-K filing and tag every primary financial statement, footnote, and cover-page data point with inline XBRL using the SEC’s GAAP Financial Reporting Taxonomy. Smaller reporting companies and emerging growth companies got phased in but are now fully subject to inline XBRL.

The consequence of bad XBRL tagging is staff comment letters and, in extreme cases, a finding that the filing is deficient and not timely. The SEC’s 2023 Sample Letter on XBRL warned filers that incorrect or missing tags violate Rule 405 of Regulation S-T. For example, Lin, the controller of a Houston energy company, fixed a recurring tagging error by purchasing a third-party validator after a 2023 staff comment letter.

Three Real-World Filing Scenarios

Filer Situation	Filing Consequence
Mid-cap retailer (large accelerated filer) misses the 60-day deadline by two days and files NT 10-K late	Loses Form S-3 eligibility for 12 months, must use Form S-1 for any capital raise, and faces Nasdaq deficiency notice under Listing Rule 5250(c)
Smaller reporting company copies prior-year Item 1A risk factors and omits a known cybersecurity breach	Faces SEC enforcement modeled on SolarWinds, where the staff charged the CISO and company with fraud for generic cyber risk language
Emerging growth company forgets to file Exhibit 19 insider trading policy with first 10-K after IPO	Violates Item 408(b), draws comment letter, and must file 10-K/A; directors lose Rule 10b5-1 affirmative defense for trades during the gap

Three Named-Person Examples

Maria, the CFO of a Delaware-incorporated biotech with a $400 million float, files as an accelerated filer with a 75-day deadline. She uses the SEC’s Financial Reporting Manual to confirm she still qualifies as a smaller reporting company because revenue is under $100 million, which lets her use scaled Item 402 executive compensation disclosure. Her audit committee pre-approves every audit and non-audit fee under Section 10A(i) before she files Item 14.

James, the general counsel of a mid-cap industrial, drafts Item 1C cybersecurity disclosure for the first time under the 2023 cyber rule. He describes the company’s NIST CSF-based program, names the board’s audit committee as the oversight body, and identifies the CISO’s 15 years of experience. He also files an Item 1.05 8-K within four business days when a material incident occurs mid-year.

Priya, the controller of a Texas energy issuer, walks through Item 7 MD&A using the SEC’s Item 303 framework. She quantifies a known trend of falling natural gas prices, discloses a $40 million customer concentration, and explains a non-GAAP measure under Regulation G. Her disclosure committee challenges every forward-looking statement and adds bespoke safe-harbor language under the PSLRA.

Mistakes to Avoid

• Generic risk factors — Copying boilerplate violates Item 105 and gives plaintiffs a Rule 10b-5 hook because warnings must be specific to the issuer.
• Missing Section 302 or 906 certifications — Forgetting Exhibit 31 or 32 makes the entire filing defective and can trigger a stand-alone enforcement charge under Section 906 of Sarbanes-Oxley.
• Late or sloppy NT 10-K — Filing Form 12b-25 without a good-faith reason violates Rule 12b-25(b)(3) and triggers loss of Form S-3 eligibility.
• Hidden known trends in MD&A — Omitting a downturn already visible to management violates Item 303, as the SEC showed in Hertz.
• Stale Part III incorporation — Failing to file the proxy within 120 days makes Part III incomplete and forces a 10-K/A under General Instruction G(3).
• Wrong filer status — Misclassifying float on the cover page violates Rule 12b-2 and creates a fundamental disclosure error.
• Bad iXBRL tagging — Missing or wrong tags violates Rule 405 of Regulation S-T and draws staff comment letters.
• Skipping Exhibit 19 or 97 — Forgetting the insider trading policy or clawback policy violates Item 408(b) and Item 402(w).
• Using a sanctioned auditor — Continuing with a firm under PCAOB or SEC sanction, like BF Borgers, forces a refile and exposes officers to liability.
• Cyber silence — Omitting Item 1C details on board oversight and management expertise violates the 2023 cyber rule and invites a SolarWinds-style charge.

Sarbanes-Oxley Certifications and Internal Controls

Sections 302 and 906 of the Sarbanes-Oxley Act of 2002 require the CEO and CFO to personally certify the accuracy of every 10-K. The Section 302 certification appears as Exhibit 31, while the Section 906 certification, which carries criminal liability of up to 20 years for a knowing false statement, appears as Exhibit 32. The exact wording is fixed by Item 601(b)(31) and cannot be altered.

Section 404(a) requires management’s annual assessment of internal control over financial reporting, and Section 404(b) requires the auditor’s separate attestation for accelerated and large accelerated filers. Emerging growth companies under the JOBS Act skip 404(b) for up to five years, and non-accelerated filers skip it permanently. The framework most issuers use is COSO 2013, which Item 9A must explicitly name.

The consequence of a false certification is severe. The SEC charged the CEO of Sito Mobile for signing a Section 302 certification despite knowing of revenue recognition problems. A common misconception is that the CFO can delegate the certification, but Section 302 is personal and non-delegable, and Section 304 lets the SEC claw back bonuses if a restatement results from misconduct.

Cybersecurity, Climate, and Other 2024–2026 Disclosure Updates

The SEC’s 2023 final cybersecurity rule added Item 1C, which requires annual disclosure of risk-management processes, board oversight, and management expertise. The same rule added Item 1.05 of Form 8-K, which requires a material-incident report within four business days, with limited Attorney General delay carve-outs for national security.

The SEC adopted a final climate disclosure rule in March 2024 that would add Items 1500-1508 of Regulation S-K and Article 14 of Regulation S-X. The rule was stayed by the Fifth Circuit and as of the latest SEC litigation update remains paused, so issuers should monitor the docket and prepare to comply if and when the stay lifts. California’s SB 253 and SB 261 impose parallel state-level emissions and climate-risk reporting that many SEC filers must follow regardless of the federal stay.

The consequence of ignoring these updates is real. SolarWinds and its CISO were charged in 2023 for misleading cyber disclosure, and several issuers received comment letters in early 2024 for thin Item 1C narratives. A common misconception is that an emerging growth company is exempt from Item 1C, but the cyber rule applies to all domestic registrants on Form 10-K with phased-in compliance.

Do’s and Don’ts of Filling Out Form 10-K

• Do start drafting at least 90 days before fiscal year-end because disclosure committees need multiple review cycles to test every claim.
• Do tailor every Item 1A risk factor to a specific business reality because Item 105 bans generic boilerplate.
• Do quantify known trends in Item 7 MD&A because Item 303 requires forward-looking discussion of demands, commitments, and uncertainties.
• Do confirm auditor PCAOB registration on the PCAOB registration database because using a barred firm forces a refile.

• Do validate iXBRL tags using the SEC’s EDGAR Filer Manual because Rule 405 violations draw staff comments.

• Don’t copy and paste prior-year disclosure without a fresh review because materialized risks must be removed from the hypothetical category.

• Don’t treat Part III incorporation by reference as automatic because the proxy must actually be filed within 120 days under General Instruction G(3).
• Don’t file an NT 10-K without a good-faith basis because Rule 12b-25(b)(3) requires the company to certify the delay was unavoidable.
• Don’t skip Exhibit 19 or Exhibit 97 because Item 408(b) makes their absence a stand-alone deficiency.
• Don’t let the CEO or CFO sign a certification before reading the entire filing because Section 302 is personal and non-delegable.

Pros and Cons of the 10-K Disclosure Regime

• Pro: Standardized line-item rules under Regulation S-K let investors compare filers across industries.
• Pro: Audited financials under Regulation S-X and PCAOB AS 3101 raise reliability and reduce capital costs.
• Pro: Sarbanes-Oxley certifications give a personal accountability hook that deters fraud at the top.
• Pro: Inline XBRL tagging under Rule 405 of Regulation S-T lets investors run automated comparisons across thousands of filers.

• Pro: Scaled disclosure for smaller reporting companies and emerging growth companies reduces compliance cost for newer filers.

• Con: The 60- to 90-day deadline strain creates real burnout in finance and legal teams.

• Con: Item 7 MD&A and Item 1A risk factor drafting often invite second-guessing in private litigation under Rule 10b-5.
• Con: Section 404(b) auditor attestation can cost mid-cap filers $1 million or more per year.
• Con: New disclosure rules like Item 1C cyber and the stayed climate rule add legal uncertainty.
• Con: Heavy line-item rules can crowd out genuinely useful narrative and turn the 10-K into a checklist exercise.

Recap of Key Court Rulings and Enforcement Actions

The Supreme Court’s decision in Basic Inc. v. Levinson (1988) established the fraud-on-the-market presumption that anchors most 10-K securities class actions. Matrixx Initiatives v. Siracusano (2011) held that even non-statistically-significant adverse events can be material if a reasonable investor would view them as altering the total mix. Macquarie Infrastructure Corp. v. Moab Partners (2024) clarified that pure omissions are not actionable under Rule 10b-5(b) without a duty to disclose, but a misleading half-truth still is.

The SEC’s 2018 Hertz case showed that hiding known trends in MD&A is a stand-alone Section 13(a) charge. The 2023 SolarWinds action put cybersecurity on the front page of Item 1A drafting. The 2024 BF Borgers shutdown reminded every filer to verify auditor standing on the PCAOB registration database before sending the engagement letter.

State-Level Nuances Layered on Federal Rules

Federal law sets the floor for 10-K disclosure, and state law layers on top of it. Delaware corporate law, including DGCL Section 220 book-and-records inspections, often forces companies to expand 10-K narratives to match what they would otherwise disclose in shareholder demand cases. New York’s Martin Act gives the state attorney general parallel fraud authority that has reached 10-K disclosures in cases like People v. Exxon.

California’s SB 253 climate disclosure law and SB 261 climate-risk law apply to large companies doing business in the state, regardless of whether the federal SEC climate rule is stayed. The consequence of ignoring state-level rules is that a 10-K can be technically correct under SEC rules and still trigger a state attorney general subpoena. A common misconception is that Delaware incorporation alone determines disclosure duties, but the company’s principal place of business, where it markets, and where its investors live all matter.

Frequently Asked Questions

Is Form 10-K the same as the annual report sent to shareholders?

No. The 10-K is the legal SEC filing, while the glossy annual report is governed by Rule 14a-3 under the proxy rules. Many companies wrap the 10-K inside the glossy report for efficiency.

Do all public companies file Form 10-K?

No. Foreign private issuers file Form 20-F instead, and Canadian issuers may use Form 40-F under the multijurisdictional disclosure system. U.S. domestic registrants under Section 12 or Section 15(d) file Form 10-K.

Can I get an extension on the 10-K deadline?

Yes. You may file Form 12b-25 (NT 10-K) on or before the original due date for an automatic 15-calendar-day extension under Rule 12b-25, but you must certify the delay could not be avoided without unreasonable effort.

Must the CEO and CFO personally sign certifications?

Yes. Sarbanes-Oxley Sections 302 and 906 require personal, non-delegable certifications attached as Exhibits 31 and 32, with Section 906 carrying criminal exposure of up to 20 years for knowing false statements.

Are smaller reporting companies exempt from Item 1C cybersecurity?

No. All domestic registrants must include Item 1C cybersecurity disclosure under the SEC’s 2023 cyber rule, although smaller reporting companies received a phased compliance schedule.

Is the SEC climate rule currently in effect?

No. The Fifth Circuit stayed the March 2024 climate disclosure rule, and the SEC paused implementation pending the litigation, so issuers should track the docket and prepare to comply later.

Can Part III be incorporated by reference from the proxy?

Yes. General Instruction G(3) lets you incorporate Items 10 through 14 from a proxy statement filed within 120 days of fiscal year-end, but missing that window forces a Form 10-K/A.

Do I have to file the insider trading policy as an exhibit?

Yes. Item 408(b) requires you to file your insider trading policy as Exhibit 19 with the annual report, and Item 402(w) requires the clawback policy as Exhibit 97.

Is auditor attestation of internal controls required for every filer?

No. Section 404(b) attestation applies only to accelerated and large accelerated filers, and emerging growth companies skip it for up to five years under the JOBS Act.

Can the SEC deregister my securities for late 10-Ks?

Yes. Under Exchange Act Section 12(j), the SEC can suspend or revoke registration for delinquent filers, and the agency runs periodic sweeps against shell companies and chronic late filers.

Must I tag the 10-K with inline XBRL?

Yes. All filers, including smaller reporting companies and emerging growth companies, must use inline XBRL on the financial statements, footnotes, and cover page under Rule 405 of Regulation S-T.

Is the Form 10-K Summary in Item 16 mandatory?

No. Item 16 is optional, and almost no filers use it because the structured 10-K body and XBRL tagging already serve the same investor-summary purpose.