A Form 10-K has a fixed structure: four parts and sixteen numbered items, most of which point to a specific item in Regulation S-K or to the financial statement rules in Regulation S-X. A checklist is therefore mostly a map from form item to rule, with a note on who owns the content and where the auditor's work meets it.
This guide walks the form in order. It paraphrases the Form 10-K instructions and the rules they cite. Read the form, Regulation S-K, Regulation S-X and the instructions for your filer status before relying on any point. For deadlines by filer category and the 8-K items that involve the auditor, see Form 10-K vs 10-Q vs 8-K.
What does Part I cover?
| Item | Subject | Rule it calls for | Smaller reporting company |
|---|---|---|---|
| 1 | Business | Regulation S-K Item 101 (description of business, including human capital resources) | Required, with scaled content |
| 1A | Risk factors | Item 105 | Not required |
| 1B | Unresolved staff comments | Applies only to accelerated filers, large accelerated filers and well-known seasoned issuers with unresolved SEC staff comments outstanding more than 180 days before year-end | Generally not applicable if not an accelerated filer |
| 1C | Cybersecurity | Item 106 (risk management, strategy and governance) | Required |
| 2 | Properties | Item 102 | Required |
| 3 | Legal proceedings | Item 103, plus terminated proceedings in the fourth quarter | Required |
| 4 | Mine safety disclosures | Item 104, if applicable | If applicable |
Item 1A asks for the material factors that make an investment speculative or risky. Item 105 discourages generic risk factors; any that are included belong at the end under a "General Risk Factors" caption. The auditor reads these items as other information but does not audit them.
What does Part II cover?
| Item | Subject | Rule it calls for | Smaller reporting company |
|---|---|---|---|
| 5 | Market for common equity, stockholder matters and issuer purchases | Items 201, 701 and 703 | Required |
| 6 | Reserved | None | None |
| 7 | MD&A | Item 303 | Required |
| 7A | Market risk disclosures | Item 305 | Not required |
| 8 | Financial statements and supplementary data | Regulation S-X; Item 302 | Article 8 of S-X may be used; Item 302 not required |
| 9 | Changes in and disagreements with accountants | Item 304(b) | Required |
| 9A | Controls and procedures | Items 307 and 308 | Required |
| 9B | Other information | Items not reported on Form 8-K in the fourth quarter; Item 408(a) | Required |
| 9C | Foreign jurisdictions that prevent inspections | Applies only to registrants the SEC has identified under Section 104(i) of the Sarbanes-Oxley Act as using an audit firm the PCAOB cannot fully inspect | Rarely applicable |
Item 7: MD&A
Management's discussion and analysis is covered in its own guide: MD&A writing guide.
Item 8: financial statements
Regulation S-X sets the periods. For a registrant that is not a smaller reporting company:
- Audited balance sheets as of the end of each of the two most recent fiscal years (Rule 3-01).
- Audited statements of comprehensive income and cash flows for each of the three fiscal years (Rule 3-02), or the shorter period the registrant has existed.
- An analysis of changes in stockholders' equity, in a note or separate statement, for each period for which an income statement is required (Rule 3-04).
A smaller reporting company may instead follow Article 8, which asks for two years of income statements, cash flows and changes in stockholders' equity (Rule 8-02), with the discussion in MD&A covering the same two-year period. Item 302 supplementary quarterly information is required only when there are material retrospective changes to the quarterly income statements and does not apply to smaller reporting companies.
Financial statements filed under Item 8 are audited under PCAOB standards for issuers. See PCAOB vs AICPA standards and critical audit matters.
Item 9A: controls and procedures
Item 308 requires three things:
- Management's annual report on ICFR, stating management's responsibility, the framework used, and management's assessment of effectiveness as of year-end, including any material weakness. Management cannot conclude ICFR is effective if there are one or more material weaknesses.
- The auditor's attestation report for accelerated and large accelerated filers, other than emerging growth companies. Non-accelerated filers do not include one.
- Changes in ICFR during the fourth quarter that materially affected, or are reasonably likely to materially affect, ICFR.
A newly public company may omit the management report and attestation in its first annual report, with a prescribed statement explaining the transition. Item 307 covers management's conclusion on disclosure controls and procedures. See SOX 404 and internal control over financial reporting.
What does Part III cover?
Items 10 to 14 cover directors, executive officers and corporate governance, executive compensation, security ownership, related party transactions and director independence, and principal accountant fees and services.
Part III can be incorporated by reference from a definitive proxy or information statement if that document is filed within 120 days after fiscal year-end. If it is not filed within that window, the Part III information must be filed in the 10-K or in an amendment no later than the end of the 120-day period.
Item 14 is where the audit firm's fees appear. It requires the aggregate fees billed for each of the last two fiscal years in four categories: audit fees, audit-related fees, tax fees and all other fees, with a description of the nature of the services in the last three. It also requires the audit committee's pre-approval policies, and, if greater than 50 percent, the share of audit hours performed by persons other than the principal accountant's full-time permanent employees. See SEC auditor independence rule 2-01.
What does Part IV cover?
- Item 15 lists the financial statements, financial statement schedules and exhibits filed with the report. Exhibits come from Regulation S-K Item 601.
- Item 16 is an optional summary. Each item in the summary must be presented fairly and accurately and hyperlinked to the material it summarizes.
The report must be signed by the registrant and, on its behalf, by the principal executive officer, the principal financial officer, the controller or principal accounting officer, and at least a majority of the board of directors.
A worked example: the Part III date
Illustrative. A calendar-year company has a December 31, 2026 year-end and plans to incorporate Part III by reference from its proxy statement.
- January 31 days + February 28 days + March 31 days + April 30 days = 120 days
- The 120-day window ends April 30, 2027.
If the definitive proxy statement is not filed by April 30, 2027, the Part III information has to be filed by that date in a 10-K amendment. Many companies set the proxy date and the audit committee calendar backward from that point.
Where does the auditor's work meet the 10-K?
| 10-K area | Auditor's involvement |
|---|---|
| Item 8 | Audit opinion on the financial statements |
| Item 9A | Attestation on ICFR for accelerated and large accelerated filers; consideration of changes in ICFR |
| Item 14 | Fees disclosed; independence and pre-approval |
| Items 1, 1A, 5, 7 and others | Not audited. For issuer audits, PCAOB AS 2710 has the auditor read other information in documents containing audited financial statements and consider whether it is materially inconsistent with the financial statements |
| Item 9 | Disagreements or reportable events connected with a change in accountants, under Item 304(b). A change in accountants separately requires an Item 4.01 8-K |
The auditor also reviews the subsequent events between the balance sheet date and the report date. See AU-C 560 for the AICPA equivalent and subsequent events.
Checklist for the close team
- Confirm filer status and smaller reporting company status as of the determination date, since they drive which items are scaled or omitted.
- Tie every number in MD&A, risk factors and the business section back to the financial statements. See tick and tie.
- Agree the Item 9A conclusion and any material weakness language with the auditor before filing.
- Decide whether Part III will be incorporated from the proxy and set the date.
Frequently asked questions
Which 10-K items can a smaller reporting company omit?
Item 1A (risk factors), Item 7A (market risk) and Item 302 supplementary financial information are not required for smaller reporting companies. It may also use the scaled financial statement requirements of Article 8 of Regulation S-X.
How many years of financial statements does a 10-K require?
Two audited balance sheets and three years of income statements and cash flows, for a registrant that is not a smaller reporting company. A smaller reporting company presents two years of income statements and cash flows under Article 8.
Does the auditor audit the MD&A?
No. MD&A is outside the audited financial statements. For issuer audits, the auditor reads other information in the filing and considers whether it is materially inconsistent with the financial statements.
When is Part III of the 10-K due?
Part III may be incorporated from a definitive proxy statement filed within 120 days after year-end. If the proxy is not filed in that window, Part III has to be filed with the 10-K or in an amendment by the end of the 120 days.
Does every 10-K filer need an auditor's ICFR report?
No. Item 308(b) requires it for accelerated and large accelerated filers other than emerging growth companies. Non-accelerated filers provide management's report only.
Sources
- SEC, Form 10-K, General Instructions D and G and Items 1 to 16, sec.gov/files/form10-k.pdf
- SEC, Regulation S-K, Items 101, 105, 106, 303, 305, 307, 308, 302, ecfr.gov, 17 CFR Part 229
- SEC, Regulation S-X, Rules 3-01, 3-02 and 3-04 and Article 8, ecfr.gov, 17 CFR Part 210
- SEC, Exchange Act Rule 12b-2 (smaller reporting company definition), ecfr.gov, 17 CFR 240.12b-2
- PCAOB, AS 2710, Other Information in Documents Containing Audited Financial Statements, pcaobus.org
Related
Part of CORAA University · SEC reporting and PCAOB audits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error