Skip to main content
Policy Authority
Category: Regulatory Disclosure

Form 10-K

Also known as: 10-K, Annual Report on Form 10-K
Simply put

Form 10-K is an annual report that certain companies file with the U.S. Securities and Exchange Commission (SEC) to give a comprehensive summary of their business and financial condition. It is one of the most detailed periodic reports a company submits to the SEC and is publicly available through the SEC's EDGAR system.

Formal definition

Form 10-K is the prescribed SEC form for annual reports filed pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934, and it may also be used for transition reports. It is commonly regarded as the most comprehensive periodic report required to be filed with the SEC, presenting information about the registrant's business operations and financial condition. Filings are submitted into and disseminated through the SEC's EDGAR system. This entry addresses the form's general purpose and scope and does not cover specific item requirements, filing deadlines, eligibility thresholds, or the distinct forms prescribed for transition periods (for example, Form 10-KT), which vary by circumstance.

Why it matters

Form 10-K is a cornerstone of the U.S. public disclosure regime. Because it provides a comprehensive summary of a registrant's business operations and financial condition, it serves as a primary reference point for investors, analysts, regulators, and counterparties seeking to understand a company's condition on the public record. Filings are disseminated through the SEC's EDGAR system, which makes them publicly available and searchable, reinforcing the form's role in market transparency.

From a compliance perspective, the Form 10-K is filed pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934, and preparing it typically draws on governance structures, internal controls, and coordination across finance, legal, and disclosure functions. Because it is one of the most detailed periodic reports a company submits to the SEC, the process of assembling it often intersects with a company's broader control and assurance environment, though the specific item requirements and deadlines vary by circumstance and are outside the scope of this entry.

This entry does not address specific filing deadlines, eligibility thresholds, item-by-item content requirements, or the distinct forms prescribed for transition periods, all of which depend on the registrant's particular circumstances. It also does not constitute legal advice; determining applicability and content obligations for a given filer requires reference to the governing SEC rules and, where appropriate, professional counsel.

Who it's relevant to

Compliance and Disclosure Officers
Professionals responsible for a registrant's SEC reporting obligations rely on the Form 10-K as a central annual disclosure filed under Section 13 or 15(d) of the Securities Exchange Act of 1934. Their focus commonly includes coordinating inputs across functions and ensuring the filing is submitted through EDGAR, though specific item requirements and deadlines fall outside this entry's scope.
Internal Auditors and Assurance Functions
Assurance professionals may reference the Form 10-K when assessing the environment surrounding a company's financial and business disclosures. Their role is to evaluate controls and processes independently rather than to prepare the filing itself, preserving the distinction between assurance activities and the management activities that produce the report.
Governance Professionals and Boards
Directors and governance staff may use the Form 10-K as a comprehensive summary of business operations and financial condition placed on the public record. It can inform oversight of the disclosure process, while the underlying decision rights and control structures that support it remain a matter of the organization's governance arrangements.
Investors, Analysts, and Counterparties
External users seeking a comprehensive summary of a company's business and financial condition can access Form 10-K filings publicly through the SEC's EDGAR system, using them as an authoritative reference point for research and due diligence.

Inside Form 10-K

Business Overview (Item 1)
A narrative description of the registrant's business, including its principal products and services, markets, competitive conditions, and material developments during the reporting period. This section frames the operating context in which governance and risk disclosures are read.
Risk Factors (Item 1A)
A discussion of the material risks that may affect the company's business, financial condition, or results. These are risk disclosures directed at investors and are distinct from an organization's internal risk register or enterprise risk management process, though they may draw on it.
Management's Discussion and Analysis (MD&A)
Management's narrative explanation of financial condition, results of operations, liquidity, and known trends or uncertainties. It reflects management's perspective and is a management activity rather than an assurance activity.
Financial Statements and Supplementary Data
Audited financial statements accompanied by the report of an independent registered public accounting firm. The external audit is an assurance function that is independent of the management that prepared the statements.
Internal Control Over Financial Reporting (ICFR) Disclosures
Management's assessment of the effectiveness of internal control over financial reporting, commonly associated with obligations under the Sarbanes-Oxley Act (SOX) in the United States. Depending on the filer's category, an external auditor may also provide an attestation on ICFR.
Corporate Governance and Related Disclosures
Information regarding directors, executive officers, corporate governance arrangements, and related matters. Certain of these items may be incorporated by reference from the company's proxy statement rather than presented in full within the form itself.

Common questions

Answers to the questions practitioners most commonly ask about Form 10-K.

Is the Form 10-K the same as a company's glossy annual report to shareholders?
No. The two are commonly confused but serve different purposes. The Form 10-K is a comprehensive annual filing prescribed by the U.S. Securities and Exchange Commission (SEC) with detailed, standardized disclosure requirements. The annual report to shareholders is typically a separate, more narrative and design-oriented document. Some companies satisfy certain requirements through a combined or wrap document, but the 10-K itself remains the regulatory filing and should not be treated as interchangeable with marketing-oriented annual reports.
Does filing a Form 10-K mean the SEC has reviewed and approved the company's disclosures?
No. Filing a Form 10-K does not constitute SEC approval or endorsement of the contents. The filing obligation rests with the registrant, and responsibility for accuracy lies with the company and its certifying officers. The SEC may review filings and issue comments, but acceptance of a filing should not be read as verification of its substance or as assurance that the disclosures are complete or free from error.
Who within the organization is typically responsible for preparing and certifying the Form 10-K?
Preparation is commonly a cross-functional effort involving finance and accounting, legal, investor relations, and internal subject-matter owners, often coordinated by a disclosure committee. Certifications are typically executed by the principal executive officer and principal financial officer. Independence distinctions matter here: management prepares and certifies the filing, while external auditors provide assurance over the financial statements and, where applicable, internal control over financial reporting. These roles should be kept distinct.
How does the Form 10-K relate to an organization's internal control over financial reporting?
The Form 10-K commonly includes management's assessment of internal control over financial reporting, and in many cases an auditor's attestation, with the applicable requirements depending on the registrant's classification and size. This ties the filing to governance and control frameworks used to design and evaluate controls. The 10-K reflects the outcome of those control processes; it is not itself a control, and its content does not substitute for the underlying control environment.
What governance and risk disclosures are typically addressed in a Form 10-K?
A Form 10-K commonly addresses risk factors, management's discussion and analysis, and other matters bearing on governance and risk oversight, with specific content requirements set by the SEC. The scope of required disclosure can vary over time and by registrant type. This entry does not enumerate current line-item requirements or cite specific item numbers, as these are subject to change; filers should consult the applicable SEC rules and forms for authoritative detail.
What are common pitfalls when coordinating a Form 10-K filing?
Frequent challenges include misaligned timelines across contributing functions, inconsistent information between the 10-K and other disclosures, inadequate documentation supporting certifications, and blurred boundaries between management's preparation role and assurance functions' independent review. Effective practice typically involves a disclosure committee, defined review cycles, and clear ownership. This entry does not provide legal advice or tooling recommendations; specific filing decisions should be validated against current SEC requirements and qualified counsel.

Common misconceptions

The Form 10-K Risk Factors section is the same as the company's enterprise risk management (ERM) output.
The Risk Factors section is an investor-facing disclosure of material risks intended to inform securities markets. It concerns compliance with disclosure requirements and is distinct from the internal ERM process of identifying, assessing, and treating risk against objectives, although the two may be informed by one another.
The Form 10-K is prepared by the external auditor.
The Form 10-K is prepared and filed by the registrant's management, which is responsible for its content. The independent registered public accounting firm provides assurance over the financial statements, and in some cases over ICFR, but this assurance role is separate from and independent of management's preparation of the filing.
Every company must file a Form 10-K.
The Form 10-K is a U.S. Securities and Exchange Commission (SEC) annual report requirement that applies to companies subject to SEC reporting obligations. It is jurisdiction-specific to the United States and does not apply universally; requirements differ by jurisdiction, and transition periods may call for a separate transition report form rather than the standard Form 10-K.

Best practices

Maintain clear separation between management's preparation of the Form 10-K and the independent assurance provided over the financial statements, preserving the auditor's independence and objectivity.
Align the Risk Factors disclosure with the organization's internal risk assessment where appropriate, while recognizing that the disclosure serves an investor-facing purpose distinct from the internal risk register.
Confirm the applicable filing obligations and filer category before relying on the standard Form 10-K, since transition periods may require a separate transition report form and requirements vary by jurisdiction.
Coordinate the ICFR assessment process across the relevant lines of responsibility so that management's assessment, and any external attestation, are supported by documented and tested controls.
Where governance disclosures are incorporated by reference from the proxy statement, verify that the referenced material is complete, current, and consistent with the information presented in the filing.
Establish a review process that engages compliance, finance, legal, and governance functions to validate accuracy and completeness before filing, without conflating assurance review with the underlying management activities.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.