Skip to main content
Regulatory Council
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Category: Disclosure & Financial Reporting

Form 10-K

Also known as: 10-K, Annual Report on Form 10-K
Simply put

Form 10-K is an annual report that certain companies must file with the U.S. Securities and Exchange Commission (SEC) to give a comprehensive summary of their business and financial condition. It is one of the most detailed periodic reports a company submits, helping investors and others understand how the company is performing. These filings are submitted through the SEC's EDGAR system and are publicly available.

Formal definition

Form 10-K is the SEC form prescribed for annual reports filed pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934, and it may also be used for certain transition reports. It is generally regarded as the most comprehensive periodic report filed with the SEC, providing information about a company's business and financial condition. Completed filings are submitted into the SEC's EDGAR system, where they are viewable as real-time and daily filings by form type. Specific filing deadlines, content requirements, and which issuers are obligated to file vary and should be verified against the current form instructions and applicable SEC rules.

Why it matters

Form 10-K is a cornerstone of the U.S. public company disclosure regime. Because it is generally regarded as the most comprehensive periodic report filed with the SEC, it serves as a primary source through which investors, analysts, lenders, and regulators assess a company's business and financial condition. Its public availability through the SEC's EDGAR system supports market transparency, allowing stakeholders to review a company's disclosures directly rather than relying solely on company-controlled communications.

From a compliance perspective, the Form 10-K represents a recurring statutory obligation for issuers subject to Section 13 or 15(d) of the Securities Exchange Act of 1934. Preparing and filing it typically draws on coordinated work across finance, legal, and internal control functions, since the filing must accurately reflect the company's financial position and operations. Inaccurate, incomplete, or late filings can expose an organization to regulatory and legal consequences, though the specific requirements, deadlines, and enforcement outcomes depend on the issuer's circumstances and the applicable SEC rules in effect.

Because the 10-K is publicly filed and widely relied upon, its integrity intersects with broader governance and risk considerations, including the reliability of internal controls over financial reporting and the accuracy of management representations. Which issuers are obligated to file, the applicable deadlines, and the detailed content requirements vary, and these specifics should be verified against the current form instructions and applicable SEC rules rather than assumed.

Who it's relevant to

Compliance Officers
Compliance functions help ensure that the annual report is prepared and filed in accordance with the applicable requirements under Section 13 or 15(d) and the current Form 10-K instructions. They are typically concerned with meeting filing obligations and confirming which requirements apply to their issuer.
General Counsel and Securities Counsel
Legal teams often oversee the accuracy and completeness of disclosures and verify the applicable rules and deadlines. Because obligations and content requirements vary and involve legal interpretation, matters of applicability may require professional advice.
Internal Auditors and Financial Reporting Teams
These functions contribute to the reliability of the financial and business information presented in the filing. Given that the 10-K is regarded as the most comprehensive periodic report, they support the integrity of the underlying data and disclosures.
Investors, Analysts, and Lenders
External stakeholders rely on the publicly available Form 10-K, accessible through the SEC's EDGAR system, to understand a company's business and financial condition and to inform their assessments and decisions.

Inside Form 10-K

Business Overview (Item 1)
A narrative description of the registrant's business, including its principal products or services, markets, competitive conditions, and other operational context that management believes material to understanding the company.
Risk Factors (Item 1A)
A discussion of the material risks facing the registrant. In many filings these are framed as potential events and their effects on the company's objectives, financial condition, or operations, and their content and specificity typically vary by company and sector.
Management's Discussion and Analysis (MD&A)
Management's narrative analysis of financial condition and results of operations, often intended to provide context that financial statements alone may not convey, including trends, uncertainties, and liquidity considerations.
Audited Financial Statements
Financial statements accompanied by an independent auditor's report. These typically include balance sheet, income statement, cash flow statement, and related notes, prepared under the applicable accounting standards.
Internal Control Over Financial Reporting (ICFR) Disclosures
Disclosures relating to management's assessment of internal control over financial reporting, which under the Sarbanes-Oxley Act (SOX) framework may also involve an auditor attestation depending on the registrant's status. ICFR is a control matter aimed at modifying the risk of material misstatement, not a guarantee against it.
Corporate Governance and Related Disclosures
Information touching on governance matters such as board and management roles, and certain disclosures that may be incorporated by reference from other filings (for example, a proxy statement), subject to the applicable rules.

Common questions

Answers to the questions practitioners most commonly ask about Form 10-K.

Is the Form 10-K the same as the glossy annual report shareholders receive?
No, though the two are often confused. The Form 10-K is a comprehensive filing submitted to the U.S. Securities and Exchange Commission under the Securities Exchange Act, containing audited financial statements and detailed disclosures in a prescribed format. The annual report to shareholders is typically a separate, more narrative document that may include marketing-oriented content. Some companies satisfy elements of the shareholder report by wrapping it around the 10-K, but the two serve different purposes and audiences, and the 10-K's content and structure are driven by regulatory requirements rather than presentation preferences.
Does filing a Form 10-K mean a company's disclosures and internal controls are guaranteed accurate?
No. Filing a 10-K reflects an obligation to disclose in accordance with SEC requirements, and it typically includes management's assessment of internal control over financial reporting, but it does not guarantee that every disclosure is accurate or that no misstatement exists. The filing represents management's and, where applicable, the auditor's conclusions as of a point in time, subject to inherent limitations. Controls modify but do not eliminate the risk of error or misstatement. The presence of a filing should not be read as an assurance of a clean outcome.
Which companies are generally required to file a Form 10-K?
In general, the annual 10-K filing obligation applies to companies subject to the reporting requirements of the U.S. Securities Exchange Act, which commonly includes companies with securities registered on a U.S. national exchange and certain others meeting reporting thresholds. Applicability depends on a company's specific registration status and other factors, and foreign private issuers may report on different forms. Because eligibility and exemptions are fact-specific and jurisdiction-dependent, companies should confirm their obligations against the applicable SEC rules and, where needed, seek professional advice.
What are the typical filing deadlines for a Form 10-K?
Filing deadlines generally depend on the filer's category, with categories such as large accelerated filers, accelerated filers, and non-accelerated filers commonly subject to different timeframes measured from the fiscal year-end. Because the specific number of days for each category is set by SEC rules and can be affected by a company's status, we recommend verifying the current applicable deadline against the primary SEC source rather than relying on a general figure.
How does the Form 10-K relate to governance, risk, and compliance responsibilities?
The 10-K spans all three GRC pillars. From a governance perspective, it reflects decision rights and oversight, including sign-off responsibilities of senior officers and the audit committee. From a risk perspective, it typically includes risk factor disclosures and, where applicable, management's assessment of internal control over financial reporting. From a compliance perspective, timely and accurate filing is a binding regulatory obligation under U.S. securities law. Coordinating legal, finance, internal audit, and disclosure functions is often central to preparing a defensible filing.
What internal processes commonly support a reliable Form 10-K?
Organizations often rely on disclosure controls and procedures, a disclosure committee or equivalent review process, and internal control over financial reporting to support the reliability of a 10-K. These typically involve gathering information across business units, evaluating the completeness and accuracy of disclosures, and documenting management's conclusions. Certification requirements applicable to senior officers may also inform the process. The specific design of these processes varies by organization size, sector, and complexity, and should be aligned with applicable SEC requirements.

Common misconceptions

The Form 10-K and a company's glossy annual report are the same document.
They are distinct. The Form 10-K is a formal annual filing made to the securities regulator with prescribed content, while the annual report to shareholders is a separate, often more marketing-oriented publication. Their content can overlap but they are not interchangeable, and specific requirements should be verified against the primary source.
The Risk Factors section is a complete or exhaustive list of every risk a company faces.
Risk Factors disclosures typically describe material risks as management identifies them, and their scope and specificity vary by company. The section is a disclosure of potential events and effects on objectives, not a comprehensive risk register or an assurance that unlisted risks do not exist.
A clean auditor's report or an ICFR assessment means the company is free of financial or compliance risk.
An audit opinion and an internal control assessment address the risk of material misstatement to a degree of reasonable assurance; they do not eliminate risk or guarantee compliance. Controls modify risk rather than remove it, and residual risk typically remains.

Best practices

Read the Form 10-K as an integrated document, cross-referencing the Risk Factors, MD&A, and financial statement notes rather than treating any single section in isolation.
Distinguish disclosed risks from the controls addressing them, and consider whether described controls speak to inherent or residual exposure when assessing the company's position.
Verify specific regulatory requirements, effective dates, and thresholds (for example, the applicability of auditor attestation over ICFR) against the primary source rules, since applicability varies by registrant status.
Confirm which content is presented directly versus incorporated by reference from other filings, such as a proxy statement, to avoid overlooking material governance disclosures.
Treat the auditor's report and management's ICFR assessment as reasonable-assurance statements, not guarantees, when using the filing to inform risk or compliance judgments.
Seek professional legal or accounting advice for matters of interpretation, jurisdiction-specific requirements, or sector-specific disclosure obligations that fall outside a general reading of the filing.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide