This year, our annual client alert with reminders for preparing the annual report on Form 10-K includes a short summary of new disclosure requirements effective this year and next year, followed by a more detailed discussion of these requirements and additional disclosure considerations. Also included are links to our related client alerts and Known Trends blog posts.

New Disclosure Requirements for 2024 Form 10-K filings:

The U.S. Securities and Exchange Commission (SEC) approved the following new disclosure requirements, which will be required to be included in Annual Reports on Form 10-K for the fiscal year ending December 31, 2024:

Cybersecurity Risk Management, Strategy, and Governance. In June 2023, the SEC approved final rules requiring issuers to disclose certain information regarding their cybersecurity risk management, strategy, and governance in their annual reports on Form 10-K. Under the final rules, issuers must disclose their cybersecurity risk management and strategy by describing their processes, if any, to assess, identify, and manage material risks from cybersecurity threats, and whether any risks from cybersecurity threats have, or are reasonably likely to have, materially affected the company, including its strategy, results of operations, or financial condition (and, if so, how). Issuers also must disclose their cybersecurity governance by describing their board of directors’ oversight of such risks as well as their management’s role in assessing and managing such risks. Issuers must first comply with these annual disclosure requirements in their Forms 10-K for fiscal years ending on or after December 15, 2023. For a more detailed discussion, please see our related Client Alert.

The final rules also require issuers to file a Form 8-K within four business days of determining that it had a material cybersecurity incident. Issuers (other than smaller reporting companies) were required to begin complying with these Form 8-K requirements on December 18, 2023. Smaller reporting companies will need to comply with these Form 8-K requirements beginning on June 15, 2024.

Director and Officer 10b5-1 Trading Plans. In December 2022, the SEC approved final rules requiring companies to disclose material terms (other than pricing terms) regarding trading arrangements of their Section 16 officers and directors. Under the final rules, issuers must disclose whether, during the quarterly period to which the periodic report relates, any of their Section 16 officers or directors adopted or terminated a Rule 10b5-1 trading plan or a non-Rule 10b5-1 trading arrangement. Under new Rule 10b5-1(c)(1)(iv), most modifications or amendments are deemed to be a termination of the existing Rule 10b5-1 plan and the adoption of a new Rule 10b5-1 plan. Issuers are required to include applicable disclosures on a quarterly basis in their Forms 10-Q and 10-K (for the fourth fiscal quarter). For a more detailed discussion, please see our related Client Alert.

Share Repurchases. In May 2023, the SEC approved final rules requiring issuers to disclose more detailed information relating to their share repurchase plans and programs and information relating to issuer Rule 10b5-1 plans adopted or terminated during the applicable quarterly period. For more information on the final rules, please see our related Client Alert. However, on December 19, 2023, the U.S. Court of Appeals for the Fifth Circuit issued an opinion vacating the final rules. In light of the Fifth Circuit’s opinion vacating the final rules, issuers should continue to disclose share repurchase information under the pre-amended version of Item 703 of Reg. S-K, which requires issuers to disclose in tabular format, by month, certain quantitative data (including, for example, the number and average price per share of shares repurchased during the quarterly period to which the report relates (for Form 10-K, during the fourth fiscal quarter)), as well as some additional qualitative information by footnote to the tabular disclosure, and issuers are no longer required to disclose information relating to issuer Rule 10b5-1 plans.

Clawback Policies. In June 2023 the SEC approved Nasdaq’s and the New York Stock Exchange’s clawback-related listing standards. Under the final rules, issuers must adopt and comply with written clawback policies and file such policies as a new Exhibit 97.1 to their Forms 10-K. Issuers also must disclose whether, during the prior fiscal year, there was either an accounting restatement requiring a clawback, or an outstanding clawback balance. In addition, the final rules added two new checkboxes to the cover page of the Form 10-K relating to whether the filing contains the correction of an error to previously-issued financial statements and whether any of those error corrections resulted in a restatement that triggered a clawback analysis.² Issuers were required to adopt clawback policies by December 1, 2023 and to comply with these annual disclosure requirements in their Forms 10-K filed on or after that date. Further, NYSE-listed issuers must provide confirmation of adoption of clawback policies or reliance on any applicable exemptions to a NYSE listing manager by December 31, 2023. For a more detailed discussion of the clawback disclosure rules, please see our related Client Alert.

Other Disclosure Considerations for Upcoming Form 10-K filings:

Management’s Discussion and Analysis (MD&A). MD&A rules require companies to “describe any known trends or uncertainties that have had or that are reasonably likely to have a material favorable or unfavorable impact on net sales or revenues or income from continuing operations.” Companies should consider disclosure of company-specific known trends, such as climate-related goals and opportunities, and artificial intelligence (AI) developments, including machine learning and generative AI. Companies discussing trends or uncertainties related to AI should be clear about what they mean when they refer to AI. In addition, companies should consider macro-economic factors that could be known trends or uncertainties, including supply chain issues, inflationary pressures, impact of foreign exchange rates, lengthening sales cycles, effects of higher interest rates, a potential government shutdown, and geo-political conflicts such as in Ukraine and Israel, and when applicable, should disclose both current and potential future impacts of geo-political and economic conditions on their business. This is particularly important given the SEC’s focus on a principles-based approach to MD&A, as detailed in our previous Client Alert.

Risk Factors. Companies should keep the substance of their risk factors updated as current risks change and new risks emerge. The considerations that companies assess for purposes of MD&A disclosure, described above, may be key areas for companies to consider when refining risk factor disclosure. Companies also should consider risks specific to their business or industry and take care to periodically review risk factors and, as needed, update risk factors to reflect actual changes in circumstances or events that have occurred, including changing any hypothetical statements if necessary. Risk factors also should be reviewed in light of changes or additions in other sections of the Form 10-K, such as the business section, cybersecurity disclosure, and financial statement notes.

In addition, companies should confirm that the structure of their risk factor disclosure is compliant with the SEC’s rules. Companies should categorize risk factors under subject matter headings and, if the risk factor disclosure is over 15 pages long, must include a risk factor summary (no longer than two pages) in their Form 10-K, which summarizes the principal risk factors.

SEC Comment Letter Trends. Based on a review of SEC comment letters on periodic reports for the 12 months ended June 30, 2023,³ the top three areas of SEC focus were: MD&A including, results of operations, critical accounting policies and estimates, key performance indicators, and liquidity and capital resource matters; non-GAAP financial measures; and segment reporting. While the volume of SEC comment letters on periodic reports for the 12 months ended June 30, 2023, increased approximately 60 percent compared to the 12 months ended June 30, 2022, the top three areas of focus were consistent with the previous two years.

Notably, climate-related comments increased by approximately 25 percent from last year, becoming the fifth most frequent comment area during 2023. In September 2021, SEC staff published a sample letter with climate-related disclosure comments that have been issued to certain companies regarding their climate-related disclosures. Many of these comments were based on the SEC’s 2010 climate change disclosure guidance. The SEC has not yet adopted final rules on climate change disclosure, but companies can consider what disclosure, if any, it should include in its annual report based on the SEC’s previous guidance. Companies also may consider other disclosure regimes that may eventually apply to it, such as the European Union’s Corporate Sustainability Reporting Directive discussed here and several recent laws adopted in California, described here and here.

In May 2022, SEC staff published a sample letter with comments relating to the conflict in Ukraine and related supply chain issues (see our previous Client Alert for more information). Although the SEC staff has not published a similar sample letter with comments relating to the conflict in Israel, the SEC staff’s comments on disclosures relating to the conflict in Ukraine may serve as a useful guide in assessing potential disclosures relating to the conflict in Israel. Companies should review sample comment letters together with related disclosures as drafting of the Form 10-K gets underway.

Controls and Procedures. Public companies are required to maintain:

• Internal accounting controls under Section 13(b)(2)(B) of the Securities Exchange Act of 1934 (Exchange Act)
• Internal control over financial reporting under Exchange Act Rules 13a-15(a) or 15d-15(a)
• Disclosure controls and procedures under Exchange Act Rules 13a-15(a) and 15d-15(a)

Management is required to evaluate and disclose management’s conclusions as to the effectiveness of disclosure controls and procedures each quarter, to disclose whether it made changes to internal controls that have materially affected, or are reasonably likely to materially affect, internal control over financial reporting each quarter, to evaluate and disclose management’s assessment of, and if required an auditor attestation to, the effectiveness of internal control over financial reporting annually. These evaluation processes are particularly important in light of recent SEC enforcement efforts regarding controls and procedures:

• SolarWinds—A litigated matter in which the SEC alleges the company made materially misleading statements and omissions regarding cybersecurity risks and that the company lacked sufficient internal accounting controls and disclosure controls and procedures.
• Activision Blizzard—SEC settlement involving alleged lack of sufficient disclosure controls and procedures regarding employee workplace misconduct complaints.
• DXC Technology—SEC settlement involving alleged absence of a non-GAAP policy and negligent misclassification of certain non-GAAP expenses; lack of sufficient disclosure controls and procedures.
• Charter Communications—SEC settlement involving alleged insufficient internal accounting controls over Rule 10b5-1 trading plans.

Legal Proceedings. While it is common practice for public companies to describe their legal proceedings in which the company is a defendant as being “without merit,” a decision from earlier this year, in City of Fort Lauderdale Police and Firefighters’ Retirement System v. Pegasystems Inc., serves as a cautionary reminder that companies should undertake diligent efforts to ensure that their claims of legal proceedings being without merit are not misleading and based on a good-faith, reasonable belief in light of the information known at the time the statements are made.

Exhibit Index. Companies should take a fresh look at the exhibit index of their Form 10-K. In addition to including their clawback policy as a new exhibit and reviewing their Forms 10-Q and 8-K filed in the last year, companies should consider whether they need to make any updates related to the certificate of incorporation or bylaws, material contracts and amendments (including immaterial amendments to material contracts that were not previously filed with periodic or current reports), the description of the capital stock (especially if they have amended their certificates of incorporation or bylaws during the past year), or the list of subsidiaries. Any expired or terminated material contracts with no continuing obligations should be removed from the exhibit index. Further, companies should check that each exhibit is hyperlinked to the correct document. When reviewing the exhibit index, check to see whether any previous grant of confidential treatment is due to expire in 2024 so that extensions can be sought, if appropriate.

Inline XBRL. In September 2023, the Division of Corporation Finance issued guidance on Inline XBRL and XBRL disclosures in the form of a sample letter to companies. The sample comments relate to cover pages, pay versus performance, and financial statements and supplementary data. It is worth noting that many of the new disclosure requirements (e.g., insider trading arrangements, cybersecurity) are required (or will be required following a transition period) to be filed in Inline XBRL. As companies prepare and review their Form 10-K filings, they should ensure that their filings fully comply with the Inline XBRL and XBRL tagging requirements. For a more detailed discussion of this sample letter, please see our previous blog post.

Section 302 and Section 906 Certifications (CEO/CFO Certifications). Companies should carefully review their Section 302 and Section 906 certifications included as exhibits to their Form 10-K. In particular, a newly public company filing its second annual report is no longer in the transition period established by the SEC and therefore its CEO and CFO need to certify their assessment of the company’s internal control over financial reporting. These companies will need to 1) update their Section 302 certifications by adding additional language so that the principal executive officer and principal financial officer make all required certifications, and ensure that their Section 302 certifications are updated in subsequent Form 10-Q filings, and 2) update the language in Item 9A, Part II of the Form 10-Ks to include management’s report on internal control over financial reporting and, if applicable, a statement regarding the outside auditor’s attestation report.

Effect of Form 10-K on Outstanding Registration Statements. The filing of the Form 10-K may require updates to outstanding registration statements. If the company has any outstanding registration statements on Form S-1 that do not permit forward incorporation by reference, then it will need to file a post-effective amendment to the Form S-1 in order to incorporate the annual financial statements by reference. If the company has any outstanding registration statements on Form S-3, then it will need to ensure that it continues to meet the eligibility requirements for using the Form S-3 as of the time it files its Form 10-K or amend onto a Form S-1. If it previously filed a well-known seasoned issuer (WKSI) shelf registration statement, it will need to confirm that it is still a WKSI in order to use that registration statement; otherwise, it will need to amend onto a form it is eligible to use.

New Disclosure Requirements for 2025 Form 10-K filings:

The SEC also approved the following new disclosure requirements to be included in Annual Reports on Form 10-K for the fiscal year ending December 31, 2025:

Insider Trading Policies and Procedures. In December 2022, the SEC approved final rules requiring new disclosures relating to issuers’ insider trading policies and procedures. Under the new rules, issuers are required to disclose whether or not they have insider trading policies and procedures for their directors, officers and employees (as well as the issuer itself) or, if not, provide an explanation for why such policies and procedures have not been adopted. While issuers are not required to describe their insider trading policies and procedures, issuers must file a copy of such policies and procedures as a new Exhibit 19.1 to their Forms 10-K. Issuers will be required to comply with these disclosure requirements in in annual reports covering the first full fiscal year that begins no or after April 1, 2023 (or October 1, 2023, for smaller reporting companies). Accordingly, calendar year-end issuers must first comply with these annual disclosure requirements in their Forms 10-K for the fiscal year ended December 31, 2024; some non-calendar year-end companies may be required to comply earlier. For a more detailed discussion, please see our related Client Alert.

Option Grant Policies and Practices. As discussed in our previous blog post, in December 2022 the SEC approved final rules requiring new disclosures relating to option awards granted close in time to the release of material nonpublic information. Under the new rules, issuers are required to disclose their policies and practices regarding the timing of grants of options, stock acquisition rights and similar derivatives, and the release of material nonpublic information. In addition, the new rules require issuers to include a table disclosing information regarding such grants to issuers’ named executive officers (NEOs) within four business days before, or one business day after, the release of material nonpublic information (e.g., the filing of a periodic report, or the filing or furnishing of a Form 8-K containing material nonpublic information, but not a Form 8-K that discloses a material new option grant under Item 5.02(e)). Issuers will be required to comply with these disclosure requirements in in annual reports covering the first full fiscal year that begins on or after April 1, 2023 (or October 1, 2023, for smaller reporting companies). Accordingly, calendar year-end issuers must first comply with these annual disclosure requirements in their Forms 10-K for the fiscal year ending December 31, 2024. For a more detailed discussion, please see our related Client Alert.

^[1] This disclosure may be incorporated by reference from the definitive proxy statement if filed not later than 120 days after fiscal year-end.

^[2]Note that SEC staff have provided informal guidance at conferences indicating that an error correction need not rise to the level of a restatement to require checking the box. In other words, a “Big R” restatement, “little r” restatement, or some other error correction under U.S. GAAP (e.g., ASC 250) would require checking the box. A change in accounting principle, out of period adjustment, reclassification, or errors in previously filed interim financial statements that do not impact the annual periods presented in the Form 10-K, would generally not require checking the box.

^[3]For SEC comment letter trend data, refer to Ernst & Young’s SEC Reporting Update – Highlights of Trends in 2023 SEC Staff Comment Letters, available for download here (last accessed December 13, 2023).