Checklist · Corporate

Public Company Disclosure and Reporting: A Practical Checklist

15 U.S.C. §§ 78

Type
Checklist
Jurisdiction
National
Date
2024-05-07
Topic
Corporate

Once a company registers a class of securities or completes a registered offering, it inherits a permanent calendar. This checklist walks the reporting company through that calendar phase by phase: determining filer status and the deadlines that follow from it, building the 10-K and 10-Q, running the four-business-day Form 8-K clock, making the materiality determination that starts the cybersecurity incident clock under Item 1.05, complying with Regulation FD, operating disclosure controls and the disclosure committee, delivering SOX 302 and 906 certifications and the SOX 404 internal-control assessment, presenting non-GAAP measures lawfully, framing guidance inside the PSLRA safe harbor, policing Section 16 insider reports, and running the proxy season. Each phase closes with the traps that generate comment letters, restatements, and enforcement. A consolidated one-glance checklist and the governing authority appear at the end.

Public Company Disclosure and Reporting: A Practical Checklist

Corporate > Securities | Published 7 May 2024 - Updated 26 October 2025 | UpLaw - uplaw.us

Going public is not an event. It is the acquisition of a permanent obligation to speak — on schedule, accurately, and to everyone at once. The disclosure calendar does not care that your CFO is on vacation or that the news is bad.

Keywords: public company reporting, Section 13(a), Form 10-K, Form 10-Q, Form 8-K, Item 1.05 cybersecurity, Regulation FD, disclosure controls, SOX 302, SOX 404, Regulation G, PSLRA safe harbor, Section 16, say-on-pay, materiality

How to use this checklist

This is a doing document for the general counsel, CFO, controller, or outside securities lawyer who owns the reporting function of a company subject to Section 13(a) or Section 15(d) of the Securities Exchange Act of 1934. It moves in thirteen phases, from filer status through the proxy season and the earnings call. Under each phase are check items you can actually work, followed by a short explanation of why it matters, and the traps.

Running through it is a worked example. Ferrymark Diagnostics, Inc. listed on Nasdaq in March of its fiscal year, raising $180 million at a valuation that leaves roughly $520 million of public float. Ferrymark has a December 31 fiscal year end, one contract manufacturer, a large hospital-system customer base, and a newly hired general counsel who has never run a reporting calendar before. We will follow Ferrymark through its first year — including the Tuesday afternoon its CISO calls.

Reporting obligations are the ongoing half of securities law; the entry half — exemptions, private placements, and registration — is covered in Raising Capital: A Startup Securities Toolkit and Raising Capital Legally: A Comprehensive Guide to Securities Exemptions for Startups. If you are still private, start there.

Phase 1 — Know your filer status and the deadlines that follow

  • [ ] Determine the source of the obligation: Exchange Act § 12(b) listing, § 12(g) registration, or a § 15(d) reporting duty triggered by an effective Securities Act registration statement. 15 U.S.C. §§ 78m(a), 78o(d).
  • [ ] Measure public float as of the last business day of the most recently completed second fiscal quarter. This single number drives almost everything.
  • [ ] Classify the company: large accelerated filer (float ≥ $700 million), accelerated filer (float ≥ $75 million but < $700 million), or non-accelerated filer. Rule 12b-2.
  • [ ] Apply the revenue carve-out before you settle on accelerated status. Since the 2020 amendments to Rule 12b-2, an issuer that qualifies as a smaller reporting company under the SRC revenue test — annual revenues below $100 million and float below $700 million — is excluded from accelerated and large accelerated filer status even though its float clears $75 million. Low-revenue companies with substantial floats are the ones this catches.
  • [ ] Separately determine smaller reporting company (SRC) status: float below $250 million, or annual revenues below $100 million combined with float below $700 million (including zero float). Note the interaction — a company can be both an accelerated filer and an SRC (for example, float of $200 million on revenue of $300 million: an SRC under the float test, an accelerated filer because float exceeds $75 million), but a company that is an SRC by reason of the revenue test cannot be an accelerated filer.
  • [ ] If the company IPO'd recently, confirm emerging growth company (EGC) status under the JOBS Act and calendar its expiration (generally the fifth anniversary of the IPO, or earlier on revenue, float, or debt-issuance triggers). The revenue threshold is indexed for inflation and has been raised more than once — confirm the current figure rather than relying on a number you remember.
  • [ ] Calendar the deadlines that follow from status: Form 10-K due 60 days after fiscal year end (large accelerated), 75 days (accelerated), or 90 days (all others); Form 10-Q due 40 days after quarter end (large accelerated and accelerated) or 45 days (all others). Rules 13a-1 and 13a-13.
  • [ ] Note the transition rule: a newly public company's first annual report is filed as a non-accelerated filer, because it has not yet had a float measurement date.
  • [ ] Confirm EDGAR filer credentials and access administration are current for every signatory and agent. The SEC has modernized EDGAR access and enrollment; verify your company's account status and authorized users before you need to file at 5:55 p.m.
  • [ ] Diary Form 12b-25 (the "NT" filing) as a fallback: it buys 15 calendar days for an annual report and 5 for a quarterly report, and the late report is deemed timely if filed within that window — but only if the Form 12b-25 is itself filed no later than one business day after the original due date and states a real reason.

Why it matters, and the traps. Nearly every question that follows — how fast you file, whether an auditor must attest to your internal controls, how much executive-compensation detail you disclose — is downstream of the float and status determinations. The classic trap is drift: a company that crosses $700 million of float in June discovers in January that its 10-K is due in 60 days, not 90, and that it now needs a Section 404(b) auditor attestation it never budgeted for. Calendar the float measurement date as a hard event.

The second trap is treating Form 12b-25 as a free pass. It is not. A late filing — even one cured under 12b-25 — can cost Form S-3 shelf eligibility (which generally requires timely filing of all reports for the preceding twelve months), can breach a credit agreement's reporting covenant, and can trigger a Nasdaq or NYSE deficiency notice that must itself be reported on Form 8-K under Item 3.01.

Ferrymark: float measured at the end of Q2 is $520 million on trailing annual revenue of $140 million. Walk the tests in order. The revenue carve-out does not apply, because revenue exceeds $100 million — so Ferrymark is an accelerated filer. It is not an SRC: its float is above $250 million, and it cannot use the revenue test either. But it remains an EGC, and that is the status that matters most in year one, because EGC status — not filer status — is what excuses the Section 404(b) auditor attestation. Its first 10-K is nonetheless filed on the 90-day non-accelerated timeline, because a newly public company has not yet had a float measurement date while subject to reporting.

Ferrymark's GC papers all four determinations in a memo to the audit committee, showing the test applied and the number used. That memo is the answer in two years when the auditor asks why Section 404(b) was never obtained — and it is the tripwire that fires when EGC status lapses on the fifth anniversary of the IPO and the 404(b) attestation suddenly becomes mandatory.

Phase 2 — The 10-K: content, MD&A, risk factors, and the annual cycle

  • [ ] Build a 10-K work plan with a drafting calendar backed out from the filing date: outline, first draft, auditor review, disclosure committee, audit committee, board, EDGAR proof, file.
  • [ ] Update Item 1 (Business) and Item 1A (Risk Factors) under Regulation S-K Item 105 — organized under headings, with a two-page summary if the risk-factor section runs longer than 15 pages, and specific to your company.
  • [ ] Draft Item 7 (MD&A) under Item 303: results of operations, liquidity and capital resources, critical accounting estimates, and — the part that gets people sued — known trends, events, and uncertainties reasonably likely to have a material effect.
  • [ ] Complete Item 1C, the cybersecurity risk management, strategy, and governance disclosure required by Regulation S-K Item 106.
  • [ ] Complete Item 9A (Controls and Procedures): the disclosure-controls conclusion, management's ICFR report, any material weakness, and the auditor attestation if required.
  • [ ] Attach the exhibits: Section 302 certifications (Exhibit 31), Section 906 certifications (Exhibit 32), the subsidiary list, the insider trading policy (Exhibit 19, required by Regulation S-K Item 408(b)), and inline XBRL tagging.
  • [ ] Run a full litigation and contingency sweep with finance, and reconcile Item 3 (Legal Proceedings) against the financial-statement contingency footnote. They must tell the same story.
  • [ ] Circulate D&O questionnaires early; they feed Part III (or the proxy statement incorporated by reference).

Why it matters, and the traps. Risk factors are the most-copied and least-read part of the document, and that is exactly the problem. Boilerplate risk factors do two bad things: they fail to warn (so they do not support the PSLRA safe harbor discussed in Phase 10), and they signal to a plaintiff's lawyer that nobody was paying attention. Worse is the stale risk factor — the company that warns it "may" suffer a supply-chain disruption in the quarter after the disruption has already happened. Courts treat a hypothetical framing of a materialized risk as a potential misstatement, not a warning.

MD&A carries its own trap, sharpened by Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257 (2024). The Supreme Court held that a pure omission — failing to disclose information Item 303 required — is not actionable under Rule 10b-5(b), which reaches false statements and misleading half-truths. That is a meaningful private-litigation defense, but do not misread it as permission. The SEC can still enforce the Item 303 obligation directly, and once you do speak, the half-truth doctrine bites hard. The relationship between disclosure defects and private fraud claims is developed in Securities Fraud Litigation: A Comprehensive Guide to Rule 10b-5 Private Actions.

Phase 3 — The 10-Q and the quarterly close

  • [ ] Lock a repeatable quarterly close calendar: books closed, review complete, draft circulated, disclosure committee meets, sub-certifications collected, audit committee reviews, file.
  • [ ] Collect sub-certifications from business-unit and functional leaders supporting the CEO/CFO certifications.
  • [ ] Refresh risk factors: Part II, Item 1A of the 10-Q requires disclosure of material changes from the 10-K risk factors. Do not simply write "none" by reflex.
  • [ ] Update legal proceedings, unregistered sales of equity, and Item 5 "Other Information" — which now includes the Item 408(a) disclosure of any Rule 10b5-1 plan adopted, modified, or terminated by a director or officer during the quarter.
  • [ ] Confirm the auditor's interim review (PCAOB AS 4105, Reviews of Interim Financial Information) is complete before filing. Rule 10-01(d) of Regulation S-X conditions the 10-Q on it.

Why it matters, and the traps. The 10-Q is where control failures surface first. The most common trap is the mechanical "no material changes" risk-factor update filed in a quarter when something plainly changed — a major customer left, a regulator opened an inquiry, a covenant was waived. The second is the Item 408(a) plan disclosure: it is new enough that companies still forget it, and it is a bright-line, checkable omission. Insider plan mechanics are covered in Insider Trading Compliance and Rule 10b5-1 Plans: A Practical Checklist.

Phase 4 — The 8-K: the triggering events and the four-business-day clock

  • [ ] Maintain a trigger map: a one-page table of the Form 8-K items with a named owner for each. At minimum: 1.01/1.02 (entry into or termination of a material definitive agreement), 1.03 (bankruptcy), 1.05 (material cybersecurity incident), 2.01 (completed acquisition or disposition), 2.02 (results of operations), 2.03–2.06 (direct financial obligations, acceleration triggers, exit costs, material impairments), 3.01 (listing-standard notice or delisting), 3.02 (unregistered equity sales), 4.01 (auditor change), 4.02 (non-reliance / restatement), 5.02 (director and officer departures, elections, and compensation arrangements), 5.03 (charter and bylaw amendments), 5.07 (shareholder vote results), 7.01 (Regulation FD), 8.01 (other events).
  • [ ] Train the people who see triggers first — the deal team, treasury, HR, the controller — to escalate within 24 hours, not to make the legal call themselves.
  • [ ] Run the clock correctly: four business days from the triggering event, with item-specific variations (Item 5.02(e) compensation arrangements and Item 5.07 vote results have their own timing rules; Item 2.02 earnings releases are keyed to the release itself).
  • [ ] Decide furnished vs. filed: Items 2.02 and 7.01 are furnished, keeping them outside Section 18 liability and outside automatic incorporation by reference into registration statements. Everything else is filed.
  • [ ] Papering the file: memorialize the date the trigger occurred, who knew, and when the materiality call was made.

Why it matters, and the traps. The 8-K clock runs from the event, not from the day legal found out about it. The single most common failure is an execution date that nobody told the lawyers about — a supply agreement signed on Friday, escalated the following Wednesday, filed a day late. Rule 13a-11(c) provides a limited safe harbor from Rule 10b-5 liability for the failure to timely file certain 8-K items, and the Form S-3 instructions preserve shelf eligibility for a limited list of late items — but both carve-outs are narrow and item-specific. Do not manage to the safe harbor; manage to the deadline.

The subtler trap is Item 1.01 materiality. "Material definitive agreement" is not limited to agreements above an accounting threshold; it means an agreement material to the company, entered into outside the ordinary course of business. A single-source manufacturing agreement can be material at a dollar value that would never move the income statement.

Ferrymark: in October, Ferrymark's contract manufacturer sends a termination notice. The GC's map assigns Item 1.02 to the VP of Operations, who escalates the same afternoon. The 8-K is filed within four business days, with the substance of the agreement, the termination date, and — critically — a description of the material relationship, without editorializing about replacement plans that have not been made.

Phase 5 — Cybersecurity incident disclosure (Item 1.05) and the materiality judgment

  • [ ] Wire the incident-response plan into the disclosure function: the CISO's escalation path must terminate at the disclosure committee, not at the IT director.
  • [ ] Build a written materiality determination protocol — who convenes, what facts are gathered, who decides, how it is documented.
  • [ ] Make the determination "without unreasonable delay" after discovering the incident. This is the real deadline. Companies fixate on the four business days and forget that the clock does not start until the determination — and that unreasonably delaying the determination is itself the violation.
  • [ ] If material, file Item 1.05 within four business days of the materiality determination: describe the nature, scope, and timing of the incident and its material impact or reasonably likely material impact on operations and financial condition.
  • [ ] Amend by 8-K/A when required information was unavailable at filing.
  • [ ] Understand the narrow national-security delay: available only if the U.S. Attorney General determines immediate disclosure poses a substantial risk to national security or public safety and so notifies the Commission. It is not a general "the FBI asked us to wait" exception.
  • [ ] Distinguish Item 1.05 (a material incident, filed) from Item 8.01 (a voluntary "other events" disclosure of an immaterial or not-yet-assessed incident). Do not file an immaterial incident under 1.05.
  • [ ] Reconcile against the state and sectoral breach-notification clocks, which run on entirely different triggers and timelines.

Why it matters, and the traps. This is the newest and most enforcement-active corner of the reporting regime. The SEC has pursued companies whose incident disclosures were technically made but materially misleading — describing a real intrusion in hypothetical or minimizing terms — and has litigated against an issuer and its CISO over pre-incident public statements about the company's security posture, with the district court in 2024 permitting claims tied to the company's public "security statement" to proceed while dismissing much of the rest. The lesson is durable regardless of that case's ultimate outcome: your security marketing is disclosure.

Do not run the securities clock and the privacy clock on the same track. The notification obligations to individuals and regulators are separate, faster, and jurisdiction-specific; see Data Breach Notification Law: A Comprehensive Guide and Responding to a Data Breach: A Notification and Incident Response Checklist. And issue a litigation hold the day the incident is identified — see Issuing a Litigation Hold and Preserving ESI: A Practical Checklist.

Ferrymark: on a Tuesday, the CISO reports that an attacker exfiltrated hospital-customer configuration data from a staging environment. The disclosure committee convenes Wednesday with facts, not speculation: scope, systems, customers affected, contractual indemnity exposure, and the practical likelihood that Ferrymark's three largest customers walk. It determines materiality on Friday and files Item 1.05 four business days later. The internal memo shows a five-day path from discovery to determination with a documented reason for each day. That memo is the difference between a judgment call and an unreasonable delay.

Phase 6 — Regulation FD: selective disclosure, and what to do after an inadvertent one

  • [ ] Identify who is covered: the rule reaches disclosures by a "person acting on behalf of an issuer" — a senior official, or any other officer, employee, or agent who regularly communicates with securities market professionals or with holders of the issuer's securities. 17 C.F.R. § 243.101(c), (f).
  • [ ] Adopt a written Reg FD policy naming authorized spokespersons — and enforce it. Everyone else says "I'll connect you with IR."
  • [ ] Before any conference, non-deal roadshow, analyst dinner, or one-on-one, pre-clear the talking points against what has been publicly disclosed.
  • [ ] For intentional disclosure of material nonpublic information: disclose publicly simultaneously (8-K under Item 7.01, or a widely disseminated press release plus a webcast with adequate notice).
  • [ ] For non-intentional disclosure: disclose promptly — within 24 hours, or before the opening of the next day's trading on the NYSE, whichever is later.
  • [ ] Know the exclusions: persons who owe a duty of trust or confidence (counsel, accountants, underwriters), persons who expressly agree to keep the information confidential, and disclosures in connection with most registered offerings.
  • [ ] Run the same discipline over social media, and confirm that any channel you rely on has been identified to investors as a channel of distribution.

Why it matters, and the traps. Reg FD is enforced by the SEC through Section 21C cease-and-desist proceedings; there is no private right of action, and an FD violation is not, standing alone, a fraud violation. That makes it feel like a soft rule. It is not — an FD case is a public, embarrassing, and entirely avoidable enforcement matter, and it typically arrives bundled with a controls charge.

The trap is the implicit confirmation. An executive who does not repeat guidance but nods at an analyst's model, or tells a portfolio manager that "you're closer than most," has selectively disclosed. The second trap is the private meeting after a public event: the 45 minutes in a conference-room breakout are where FD problems are born. If it happens, act inside 24 hours — the prompt-disclosure cure is generous, and companies lose it by spending three days debating whether anything was really said.

Phase 7 — Disclosure controls and procedures; the disclosure committee

  • [ ] Adopt disclosure controls and procedures ("DCP") under Rule 13a-15(a) and (e): controls designed to ensure that information required to be disclosed is recorded, processed, summarized, and reported within the required time periods and accumulated and communicated to management to allow timely decisions.
  • [ ] Charter a disclosure committee — GC, CFO, controller, chief accounting officer, head of IR, CISO, and business-unit representation — with a written charter and minutes.
  • [ ] Meet on a standing quarterly cadence, and on demand for 8-K triggers and incident materiality calls.
  • [ ] Evaluate DCP effectiveness as of the end of each quarter and state the conclusion in Item 4 of the 10-Q and Item 9A of the 10-K.
  • [ ] Document the evaluation. A conclusion without a record is a conclusion the SEC will treat as unsupported.

Why it matters, and the traps. DCP is the mechanism that makes everything else in this checklist actually happen — and it is a favorite SEC charge because it does not require proving scienter. Note the trap that catches sophisticated companies: DCP is broader than ICFR. It covers non-financial information — cybersecurity incidents, legal proceedings, executive departures. A company with immaculate financial controls can still have deficient disclosure controls if its CISO has no path to the disclosure committee. The board's oversight duty over this system is a fiduciary matter in its own right; see Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers and, for the mechanics of documenting board process, Board Governance, Minutes, and Corporate Formalities: A Practical Checklist.

Phase 8 — SOX 302 and 906 certifications and SOX 404 internal control over financial reporting

  • [ ] File the Section 302 certification (15 U.S.C. § 7241; Rule 13a-14) as Exhibit 31 with every 10-K and 10-Q, signed personally by the CEO and CFO: no untrue statement of material fact, fair presentation, responsibility for DCP and ICFR, disclosure to auditors and the audit committee of any material weakness or fraud involving management.
  • [ ] File the Section 906 certification (18 U.S.C. § 1350) as Exhibit 32. This one is criminal: knowing false certification carries fines up to $1,000,000 and up to 10 years; willful, up to $5,000,000 and 20 years.
  • [ ] Support the certifications with a sub-certification cascade from the people who actually know the facts.
  • [ ] Under Section 404(a), deliver management's annual assessment of ICFR using a recognized framework (COSO 2013 in practice).
  • [ ] Determine whether Section 404(b) auditor attestation applies: it is required of accelerated and large accelerated filers, and not of non-accelerated filers (Dodd-Frank § 989G), of low-revenue companies caught by the Rule 12b-2 revenue carve-out, or of emerging growth companies for as long as EGC status lasts. Confirm your status against the current Rule 12b-2 definitions — these thresholds have been amended — and calendar the EGC expiration, because 404(b) lands the year it lapses.
  • [ ] Classify any deficiency correctly: material weakness (a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis — must be disclosed, and ICFR cannot be effective) versus significant deficiency (reported to the audit committee).
  • [ ] If a restatement becomes necessary, file Item 4.02 (non-reliance) within four business days of the board or officers' conclusion, and run the Rule 10D-1 clawback analysis under your exchange-mandated recovery policy.

Why it matters, and the traps. The 302 certification is the hinge on which individual liability turns: it converts "the company's filing was wrong" into "you personally said it was right." The 906 certification is the criminal analog and is the reason CEOs and CFOs should never treat certification as a signature page — the intersection with corporate criminal exposure is mapped in White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

The recurring trap is material-weakness euphemism. Companies negotiate themselves down to "significant deficiency" to preserve an "effective" ICFR conclusion, then restate two quarters later. The restatement is survivable; the demonstrably wrong effectiveness conclusion, signed under 302, is what turns a bad quarter into an SEC investigation and a securities class action. If you receive a subpoena or a Wells notice on the back of one, see SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies and Responding to an SEC Investigation and Wells Notice: A Practical Checklist.

Phase 9 — Non-GAAP financial measures under Regulation G and Item 10(e)

  • [ ] Inventory every non-GAAP measure the company uses: adjusted EBITDA, adjusted operating margin, free cash flow, constant-currency revenue, ARR.
  • [ ] For any public disclosure of a non-GAAP measure, comply with Regulation G (17 C.F.R. §§ 244.100–244.102): present the most directly comparable GAAP measure, provide a quantitative reconciliation, and do not present the measure in a way that is misleading.
  • [ ] For filings (and, via Item 2.02 of Form 8-K, for earnings releases), also comply with Item 10(e) of Regulation S-K: give the GAAP measure equal or greater prominence; do not exclude cash-settled charges from liquidity measures; do not label a charge "non-recurring" if a similar charge is reasonably likely to recur within two years.
  • [ ] Define each measure consistently period to period, and disclose and explain any change in the definition.
  • [ ] Do not present individually tailored recognition and measurement methods (for example, an "adjusted revenue" that accelerates revenue GAAP would defer). The SEC's staff guidance treats these as inherently misleading.
  • [ ] Never disclose a non-GAAP forecast without the comparable GAAP forecast or a statement that the reconciliation is unavailable without unreasonable effort — and the reason.

Why it matters, and the traps. Non-GAAP presentation is the single most frequent subject of SEC comment letters, and the staff's compliance and disclosure interpretations have grown steadily more aggressive. The prominence trap catches almost everyone: a headline reading "Ferrymark Reports Record Adjusted EBITDA of $22 Million" with GAAP net loss disclosed in a table on page four is an equal-or-greater-prominence violation, full stop. So is a bulleted summary that lists three non-GAAP metrics and one GAAP metric.

The deeper trap is the adjustment that quietly becomes permanent. A company that excludes "restructuring costs" in six consecutive quarters is not excluding a non-recurring item; it is reporting a fictional cost structure — and it has handed a plaintiff a ready-made theory of misleading presentation.

Phase 10 — Forward-looking statements, guidance, and the PSLRA safe harbor

  • [ ] Decide, as a matter of policy, whether the company gives guidance at all — and if so, what metrics and what cadence.
  • [ ] Identify forward-looking statements as such ("we expect," "we anticipate," "our outlook is").
  • [ ] Accompany them with meaningful cautionary statements identifying important factors that could cause actual results to differ materially. 15 U.S.C. § 78u-5(c)(1)(A)(i).
  • [ ] Make the cautionary language specific and current. Boilerplate warnings, and warnings about risks that have already materialized, do not qualify.
  • [ ] Include the legend in every earnings release, script, and investor deck — and read it, or incorporate it by reference, on the call.
  • [ ] Know the exclusions: the statutory safe harbor is unavailable for, among others, IPO issuers, penny-stock and blank-check issuers, statements in connection with tender offers and going-private transactions, and financial statements prepared under GAAP.
  • [ ] Understand the actual-knowledge prong: even outside the cautionary-statement path, a forward-looking statement is protected unless the plaintiff proves it was made with actual knowledge of its falsity.
  • [ ] Update guidance publicly and simultaneously. There is generally no free-standing duty to update, but a company that has spoken and knows its statement has become materially false cannot let the market keep relying on it.

Why it matters, and the traps. The safe harbor is a genuine, powerful defense — and it is a drafting defense. It is won or lost on the specificity of the cautionary language you wrote before the miss. The common-law "bespeaks caution" doctrine provides a parallel path where the statute does not reach.

The trap is mixing tenses. "We expect margins to expand because our new line is running at full yield" contains a forward-looking projection and a present statement of fact. Courts routinely strip the safe-harbor protection from the embedded factual assertion. Say what you expect; separately, and truthfully, say where you are.

Phase 11 — Section 16: Forms 3, 4, and 5; short-swing profits

  • [ ] Maintain a current list of Section 16 insiders: directors, officers within Rule 16a-1(f), and beneficial owners of more than 10% of a registered class. 15 U.S.C. § 78p.
  • [ ] File Form 3 within 10 days of becoming an insider (or by the effectiveness of the registration statement, for an IPO).
  • [ ] File Form 4 within two business days of a reportable transaction — and check the Rule 10b5-1(c) box where applicable.
  • [ ] File Form 5 within 45 days of fiscal year end for exempt or previously unreported transactions.
  • [ ] Obtain EDGAR filing codes and powers of attorney for every insider before the first transaction, not on the day of it.
  • [ ] Structure issuer grants and dispositions to fall within Rule 16b-3 (board or committee approval, or shareholder approval, or a six-month holding period) so they are exempt from short-swing matching.
  • [ ] Run a six-month window check before any insider transaction: Section 16(b) requires disgorgement to the issuer of any profit from a purchase and sale (or sale and purchase) within any six-month period, matching the lowest purchase against the highest sale. It is strict liability — intent, and even the absence of any inside information, is irrelevant.
  • [ ] Track equity-award timing under Regulation S-K Item 402(x), which requires disclosure of policies on granting options close in time to the release of material nonpublic information.

Why it matters, and the traps. Section 16(b) is the least forgiving rule in this document. The plaintiff's bar monitors EDGAR for matchable transactions and sends demand letters to the issuer, which must then sue its own director. There is no good-faith defense. The trap is the unnoticed purchase — an ESPP acquisition, a 401(k) fund exchange, a dividend reinvestment, a spouse's brokerage account — matched against an open-market sale five months later.

The other trap is the officer-status determination: Rule 16a-1(f) turns on function, not title. A "Senior Vice President" who runs a principal business unit is an officer; the company that failed to designate her has both a Section 16 problem and a delinquent-filer disclosure in its proxy statement. Insider trading policy design, blackout windows, and 10b5-1 plan architecture are treated in depth in Insider Trading Compliance and Rule 10b5-1 Plans: A Practical Checklist.

Phase 12 — Proxy statements, say-on-pay, and shareholder proposals

  • [ ] Build the annual meeting calendar backwards from the meeting date: record date, Rule 14a-8 proposal deadline, preliminary proxy (if required), definitive proxy, notice-and-access mailing under Rule 14a-16, broker search card.
  • [ ] Prepare Schedule 14A under Section 14(a) and Regulation 14A: director nominees and qualifications, corporate governance, audit-fee disclosure, related-party transactions (Item 404), Compensation Discussion & Analysis and the compensation tables (Item 402).
  • [ ] Include pay ratio (Item 402(u)) and pay versus performance (Item 402(v)) disclosure.
  • [ ] Conduct the say-on-pay advisory vote under Rule 14a-21 — at least once every three years — and the say-on-frequency vote at least once every six years. Dodd-Frank § 951; 15 U.S.C. § 78n-1.
  • [ ] Handle Rule 14a-8 shareholder proposals on the clock: proposals are generally due 120 calendar days before the anniversary of the prior year's proxy release date, and a company seeking to exclude one must submit its no-action request to the staff no later than 80 calendar days before filing the definitive proxy. Confirm the current eligibility thresholds (they were amended in 2020 to a tiered ownership-duration test) rather than relying on the old $2,000/one-year rule from memory.
  • [ ] If the election is contested, comply with the universal proxy rules (Rule 14a-19), including the notice and minimum-solicitation requirements.
  • [ ] File the vote results on Form 8-K, Item 5.07 within four business days of the meeting.

Why it matters, and the traps. Proxy disclosure is where governance becomes public. A failed say-on-pay vote is advisory and non-binding — and it is also a proxy-adviser flag, an activist invitation, and, in the worst case, a predicate for a derivative suit alleging the board disregarded shareholder sentiment.

The trap is treating the proxy as a compensation document rather than a disclosure document. Related-party transactions under Item 404, director independence determinations, and delinquent Section 16 filings all live in the proxy, and all three are routine sources of restated disclosure. Run the proxy through the disclosure committee with the same rigor as the 10-K.

Phase 13 — Earnings releases, quiet periods, and investor communications

  • [ ] Adopt a quiet-period policy: a defined window (commonly from a set date before quarter end through the earnings call) in which the company does not meet with analysts or investors or comment on results.
  • [ ] Pre-clear the earnings release, the prepared remarks, and the anticipated Q&A. Assume every word will be read back to you in a deposition.
  • [ ] Issue the release, then furnish it under Item 2.02 of Form 8-K.
  • [ ] Give the exchange the advance notice its listing standards require before releasing material news during market hours, and disclose material information promptly as required by the NYSE Listed Company Manual or the Nasdaq listing rules — obligations that run in parallel with, not instead of, the 8-K rules.
  • [ ] Provide adequate advance public notice of the webcast, keep it open to all, and archive it.
  • [ ] Control the live Q&A: the answer to a question that would require disclosing material nonpublic information is "we're not going to get into that," not an improvisation.
  • [ ] Log every investor interaction: who, when, what was said, and what was already public.

Why it matters, and the traps. The earnings call is where Regulation FD, the PSLRA safe harbor, and non-GAAP rules all collide in real time, in front of a live audience, without a lawyer's red pen. Most disclosure disasters are unscripted answers. The single highest-leverage control is a disciplined, rehearsed Q&A and a spokesperson willing to decline.

Ferrymark, one year in: the disclosure calendar is a standing artifact; the disclosure committee meets on a cadence and on demand; the CISO has a seat at the table; every earnings script is legal-reviewed; and the GC's 8-K trigger map hangs in three departments. That is what a functioning reporting company looks like. It is unglamorous, and it is the whole job.

A note on SEC guidance, staff interpretations, and how much deference they get

Much of the day-to-day law in this checklist is not statute and not even rule text. It is staff material: Compliance and Disclosure Interpretations, Division of Corporation Finance comment letters, "Dear CFO" letters, and speeches. That material is enormously useful — it tells you what the reviewers actually think — and it is also the least stable layer of the stack. Two disciplines follow.

  • [ ] Treat staff guidance as persuasive, not binding. C&DIs are not rules; they are not adopted through notice and comment, and they do not have the force of law. They can be, and are, withdrawn and rewritten without ceremony.
  • [ ] Understand that the deference landscape has changed. Chevron deference — the doctrine under which courts deferred to an agency's reasonable construction of an ambiguous statute it administers — was overruled in Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024). Courts now exercise independent judgment in interpreting statutes, giving an agency's interpretation only the weight its persuasiveness earns, in the manner of Skidmore v. Swift & Co., 323 U.S. 134 (1944). Do not brief, and do not plan, on the assumption that a court will defer to the Commission's reading of the Exchange Act.
  • [ ] Note the related current-law markers a securities practitioner should have in view: SEC v. Jarkesy, 603 U.S. 109 (2024) (Seventh Amendment jury right for SEC civil-penalty claims seeking legal remedies, constraining in-house adjudication), Corner Post, Inc. v. Board of Governors of the Federal Reserve System, 603 U.S. 799 (2024) (an APA facial challenge accrues when the plaintiff is injured, extending the practical window to challenge older rules), and the major-questions doctrine, which is a live constraint on ambitious SEC rulemaking.
  • [ ] Do not confuse "the staff has never objected" with "the rule permits it." Comment-letter silence is not a safe harbor.

Why it matters, and the traps. The practical consequence is not that you can ignore the staff — you cannot; they review your filings. It is that a rule you dislike is more vulnerable to challenge than it was a few years ago, and an interpretation you rely on is less durable than it looks. Compliance strategy should track the rule text and the statute; litigation strategy should not assume the Commission gets the benefit of the doubt.

Common Mistakes to Avoid

  1. Starting the 8-K clock when legal finds out. It starts at the event. Build escalation into the business, not into the law department.
  2. Waiting to make the cybersecurity materiality call. Item 1.05's four business days run from the determination, and the determination must be made without unreasonable delay. Slow-walking the determination is the violation.
  3. Filing an immaterial cyber incident under Item 1.05. Use Item 8.01 for voluntary disclosure. Misusing 1.05 dilutes the signal and invites questions about your materiality process.
  4. Hypothetical risk factors for risks that already happened. "We may experience" is a warning. "We may experience" after you experienced is a misstatement.
  5. Non-GAAP headlines with GAAP in a footnote. Equal or greater prominence is a rule, not a preference.
  6. Boilerplate cautionary language. The PSLRA safe harbor is earned in the drafting, not asserted in the briefing.
  7. Confusing DCP with ICFR. Disclosure controls cover cyber, litigation, and executive departures — everything financial controls do not.
  8. Negotiating a material weakness into a significant deficiency. The restatement will come anyway; only the false effectiveness conclusion is optional.
  9. Missing Form 4s and Section 16(b) matches. Two business days, strict liability, and a plaintiff's bar that reads EDGAR for a living.
  10. The private breakout after the public presentation. That is where Regulation FD violations are made. If one happens, cure it within 24 hours.
  11. Assuming Macquarie means omissions are safe. It limits private Rule 10b-5(b) claims for pure omissions. The SEC's Item 303 enforcement authority and the half-truth doctrine are undisturbed.
  12. Forgetting that a late filing costs S-3 eligibility. The shelf you will need for your next raise dies quietly, twelve months at a time.
  13. Citing Chevron, or assuming the SEC's reading wins. Chevron was overruled by Loper Bright in 2024. Courts now interpret the Exchange Act independently; staff C&DIs are persuasive at best. Plan compliance to the rule text and the statute.
  14. Relying on a remembered threshold. Filer-status floats, the EGC revenue ceiling, HSR thresholds, tariff rates, and sanctions lists all change on their own schedules. Look every one of them up, every time.

The Consolidated Disclosure Checklist

Status and calendar

  • [ ] Public float measured; filer status, SRC status, and EGC status documented
  • [ ] 10-K, 10-Q, proxy, and Section 16 deadlines calendared for the full year
  • [ ] EDGAR credentials, powers of attorney, and filing agent access current
  • [ ] Form 12b-25 procedure understood as a fallback, not a plan

Periodic reports

  • [ ] 10-K work plan with disclosure committee, audit committee, and board gates
  • [ ] Risk factors refreshed and company-specific; no materialized risk framed as hypothetical
  • [ ] MD&A addresses known trends and uncertainties
  • [ ] Item 1C / Item 106 cybersecurity governance disclosure complete
  • [ ] Legal proceedings reconciled to the contingency footnote
  • [ ] Exhibits 19, 31, and 32 attached; inline XBRL tagged
  • [ ] 10-Q Part II risk-factor update and Item 408(a) 10b5-1 plan disclosure completed each quarter

Current reports

  • [ ] 8-K trigger map with named owners, distributed to the business
  • [ ] Four-business-day clock run from the event
  • [ ] Furnished vs. filed decision made deliberately (Items 2.02 and 7.01)
  • [ ] Cyber materiality protocol written; determination documented and timely

Controls and certification

  • [ ] Disclosure controls and procedures documented and evaluated quarterly
  • [ ] Disclosure committee chartered, staffed (including the CISO), and minuted
  • [ ] Sub-certification cascade collected
  • [ ] SOX 302 and 906 certifications executed; SOX 404(a) assessment complete; 404(b) attestation obtained if required
  • [ ] Deficiencies classified honestly; Item 4.02 and Rule 10D-1 clawback procedures ready

Communications

  • [ ] Reg FD policy adopted; authorized spokespersons named; 24-hour cure procedure ready
  • [ ] Non-GAAP measures inventoried, reconciled, and presented with GAAP prominence
  • [ ] Forward-looking legend current, specific, and used in every investor communication
  • [ ] Quiet-period policy in force; earnings script and Q&A pre-cleared
  • [ ] Investor-interaction log maintained

Insiders and shareholders

  • [ ] Section 16 insider list current; Forms 3/4/5 filed on time
  • [ ] Rule 16b-3 exemptions perfected for issuer grants; six-month window checked before every trade
  • [ ] Proxy statement, say-on-pay, pay ratio, and pay-versus-performance disclosures complete
  • [ ] Rule 14a-8 deadlines and no-action timing calendared; Item 5.07 vote results filed

Primary Authority

Statutes

Rules and regulations

  • Rules 12b-2 (filer definitions), 12b-25 (late filing), 13a-1 (annual reports), 13a-11 (current reports), 13a-13 (quarterly reports), 13a-14 (certifications), 13a-15 (disclosure controls and ICFR)
  • Regulation S-K, 17 C.F.R. Part 229 — Item 105 (risk factors), Item 106 (cybersecurity risk management, strategy, governance), Item 303 (MD&A), Item 402 (executive compensation, including 402(u), 402(v), 402(x)), Item 404 (related-party transactions), Item 408 (insider trading policies and 10b5-1 plan disclosure), Item 10(e) (non-GAAP in filings)
  • Form 8-K, 17 C.F.R. § 249.308, including Item 1.05 (material cybersecurity incidents), Item 2.02 (results of operations), Item 4.02 (non-reliance), Item 5.02, Item 5.07, and Item 7.01
  • Regulation FD, 17 C.F.R. §§ 243.100–243.103
  • Regulation G, 17 C.F.R. §§ 244.100–244.102
  • Regulation 14A and Schedule 14A, including Rules 14a-8, 14a-16, 14a-19 (universal proxy), and 14a-21 (say-on-pay)
  • Rules 16a-1 through 16b-3; Rule 10b5-1; Rule 10D-1 (clawback listing standards)
  • NYSE Listed Company Manual and Nasdaq listing rules on prompt disclosure of material information

Cases

Secondary sources

  • SEC Division of Corporation Finance, Compliance and Disclosure Interpretations (non-GAAP measures; Regulation FD; Exchange Act forms) — updated frequently; check the current version
  • COSO, Internal Control — Integrated Framework (2013)
  • Loss, Seligman & Paredes, Securities Regulation

Accuracy note — read before relying on any number in this document.

  • Thresholds move; verify them. Filer-status and smaller-reporting-company thresholds, the EGC revenue ceiling (which is indexed for inflation), Rule 14a-8 eligibility thresholds, and the SEC's staff interpretations of Regulation G and Item 1.05 have all been amended in recent years and continue to move. Every dollar figure in this checklist is a prompt to pull the current rule text, not a substitute for it.
  • Deal-adjacent thresholds move faster still. If a transaction drives your disclosure — an Item 1.01 or Item 2.01 8-K, a merger proxy — note that Hart-Scott-Rodino reporting thresholds and filing fees are revised annually, and that tariff schedules and OFAC sanctions and restricted-party lists change constantly, sometimes weekly. Never rely on a remembered HSR size-of-transaction number, duty rate, or sanctions designation. Confirm each against the current official source on the day you need it.
  • The adjacent regimes are state law, and they genuinely differ. The securities-reporting regime in this checklist is federal. The obligations that most often run alongside it are not. Data-breach notification to individuals and regulators is governed by state statutes (and sectoral rules) with materially different triggers, deadlines, and content requirements; there is no single nationwide breach-notification rule. Likewise, the tort, products-liability, and insurance-coverage consequences of a disclosure event are state law and vary by jurisdiction. Do not generalize a rule you learned in one state to the country.
  • Agency guidance is not law. See the deference discussion above: Chevron was overruled by Loper Bright (2024), and SEC staff C&DIs and comment-letter positions are persuasive, not binding.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; verify current requirements and consult qualified counsel before acting.