Regulation S-K Disclosure Requirements

Regulation S-K is the Securities and Exchange Commission’s codified disclosure rulebook for qualitative, narrative, and risk information. Unlike Regulation S-X, which prescribes financial statement formats, Regulation S-K tells public companies what they must write about their business, strategy, risks, management, and executive compensation—and how detailed that writing must be.

Regulation S-K is the narrative backbone of disclosure

Regulation S-X dictates how a company’s income statement and balance sheet look—revenue rows, asset columns, footnote formats. Regulation S-K covers everything else: what the company actually does, what could go wrong, how management sees the future, what the CEO earns, and who the board is. If Regulation S-X is accounting, Regulation S-K is communication.

The SEC introduced the modern version of Regulation S-K in the 1970s, codifying what companies had long been writing in prospectuses and proxy statements. The idea was simple: investors need to understand the business, not just the numbers. Over decades, Regulation S-K has grown. It now runs hundreds of pages and covers disclosures that barely existed in 1970—cybersecurity risks, climate impact, human-capital strategy, and supply-chain exposure.

The business description: how to explain what you do

Item 101 of Regulation S-K requires a company to describe its business in enough detail that an investor can understand what the company does, how it makes money, and what it sells. This sounds straightforward but is surprisingly hard to write well. A software company must explain its product, its customers, its sales model (licensed to enterprises? sold per user? free with ads?), and its competition. A real estate company must disclose its portfolio composition, geographic concentration, tenant creditworthiness, and lease terms.

The regulation does not dictate length. A startup with one product and one customer segment might use two pages; a conglomerate with dozens of divisions might use 20. The SEC’s instruction is to provide “such information as will indicate the general nature and scope of the business.” The Materiality Standard in Securities Law applies. If the company’s revenue is split 80/20 between two segments, the business description must illuminate both, not hide the smaller one.

Many companies structure the business description with subsections: products and services, customers, revenue sources, suppliers and sourcing, distribution channels, competition, regulation, and seasonality. This modular approach makes it easier to follow and easier for the company to update when something changes.

Risk factors: the permission slip to tell the truth

Item 503 (and Item 1A in the 10-K) requires companies to disclose risk factors—the known trends, uncertainties, and events that could harm the business. This is where a company can discuss competitive threats, regulatory uncertainty, supply-chain concentration, currency exposure, litigation, and even remote but catastrophic risks.

Risk factors are meant to be comprehensive but concise. A typical public company’s risk section lists 20 to 50 risks, each explained in one to three paragraphs. The items should be ranked by importance, though the SEC does not mandate a strict hierarchy. The risk factors must be specific to the company, not generic boilerplate (“We face competition” is too vague; “We compete with three firms controlling 60 per cent of the market, and two of them are better capitalized” is useful).

Many investors view the risk-factor section as a legal-compliance necessity that management writes to avoid liability if something goes wrong. In practice, it is that—but also a window into what the board and counsel believe are the real threats. A company that omits a material risk it knew about faces Securities and Exchange Commission enforcement for incomplete disclosure. So companies err toward comprehensiveness.

MD&A: management’s view of financial performance and liquidity

Item 7 in the 10-K (Regulation S-K Item 303) requires Management Discussion and Analysis—MD&A, often 10 to 40 pages. The MD&A explains the financial results. Why did revenue rise or fall? What caused changes in operating expenses? How did the company’s liquidity position evolve? What is management’s outlook for future periods?

MD&A is the bridge between the raw financial statements and the narrative explanation. A company’s revenue might have risen 15 per cent, but without MD&A, an investor does not know whether that growth came from organic volume increases, price increases, acquisitions, or currency effects. MD&A forces management to tell the story.

The regulation also requires discussion of liquidity and capital resources. Where does the company get cash? How much does it have on hand? What are its debt obligations? Is it reliant on credit lines? Can it fund operations, capital expenditures, and debt service from cash flow, or does it need external financing? For companies in distress, this section often reveals the severity of the problem before the financial statements do.

MD&A must also discuss trends, uncertainties, and known material commitments. If a company is seeing demand soften, the MD&A should say so. If a customer contract is about to expire, it should be flagged. If a lawsuit is pending, its potential impact should be disclosed. The SEC has made clear that MD&A is not a puffery section; it is where material risks and trends belong.

Executive compensation and related-party transactions

Items 10 and 14 require disclosure of executive compensation (including salary, bonus, stock options, and perquisites) and information about directors and executive officers. Large companies now disclose named executive officer compensation in extraordinary detail: base salary, cash bonus targets and payouts, restricted stock grants, option grants, pension value, and the tax implications of certain arrangements.

The regulation also requires a “Compensation Discussion and Analysis”—CD&A—explaining the board’s compensation philosophy, the metrics used to determine bonuses, and why the board believes the compensation structure is reasonable. This section is often contentious, as investors and proxy advisory firms scrutinise whether executive pay is aligned with company performance.

Item 13 requires disclosure of related-party transactions—dealings between the company and its directors, officers, or their families. If a CEO’s brother is hired as a contractor, or if the company buys services from a firm partially owned by a director, those transactions must be disclosed and the board must confirm they were fair and arm’s-length.

Internal controls and CEO certification

Items 9A and 15 of the 10-K require management to assess the effectiveness of internal controls over financial reporting and disclose any material weaknesses. The Dodd-Frank Act and the Sarbanes-Oxley Act require the CEO and CFO to certify that the 10-K is accurate and that controls are in place. If a company identifies a material weakness—a deficiency that could allow a misstatement to go undetected—it must say so publicly.

This disclosure requirement has real consequences. If a company discloses a material weakness, investors and analysts become more cautious. The company’s cost of debt may rise. The stock may fall. So companies invest heavily in remediation to fix weaknesses before disclosure becomes mandatory.

Plain English and principle of readability

The SEC requires that Regulation S-K disclosures be written in plain English—short sentences, active voice, everyday words rather than jargon. The rule sounds simple but is honoured more in the breach. Legal and accounting teams often produce dense, careful prose that technically satisfies Regulation S-K but is nearly unreadable.

In recent years, the SEC has pushed back on overly complex language, issuing comment letters to companies asking them to simplify sections of their filings. The SEC’s plain English principle is a reminder that Regulation S-K is not written for lawyers; it is written for investors. An ordinary person should be able to read a company’s business description and understand what the company does.

Evolution and recent additions

Regulation S-K has expanded significantly since 2000. The SEC added human capital disclosure requirements in 2020, asking companies to describe their workforce, talent management, and labor practices. In 2022, the SEC proposed new climate disclosure requirements under Regulation S-K Item 1505, mandating disclosure of greenhouse-gas emissions, climate scenario analysis, and governance. These additions reflect investor demand for non-traditional metrics that correlate with long-term business risk.

Not all companies welcome these expansions. Resource-intensive disclosures (climate, diversity, supply-chain mapping) impose costs, especially for smaller firms. But the Securities and Exchange Commission has determined that investors need this information to assess risk, so companies must comply.

See also