How to Read a 10-K

What a 10-K actually is

The 10-K is the comprehensive annual report every US public company is required to file with the SEC. It is much more detailed than the glossy annual report companies mail to shareholders. The 10-K is filed under penalty of perjury by the CEO and CFO, audited by independent accountants, and structured according to a specific SEC outline that has been in place for decades.

Large accelerated filers — most well-known public companies — must file within 60 days of fiscal year-end. Smaller companies get 75 or 90 days. A delayed filing triggers an NT 10-K notification, which is itself a meaningful red flag.

Why this matters more than the glossy annual report

Annual reports companies send to shareholders are marketing materials — designed to make a case. The 10-K is the regulated version. Anything stated inside has legal consequences if it later proves materially false. That asymmetry is why analysts and serious investors read the 10-K first and the glossy report second (or not at all).

You will find things in a 10-K that almost never appear in marketing materials: customer concentration, supplier dependencies, ongoing litigation, tax-rate sensitivities, material weaknesses in internal controls, and explicit warnings about how things could go wrong.

Section-by-section: what to read and what to skip

Item 1 — Business

Describes what the company does, its segments, geographies, customers, and competitive position. For a company you already follow, this is mostly familiar — skim it. For a new name, read it carefully. Pay particular attention to segment definitions; companies sometimes redefine segments to mask weakness in one area.

Item 1A — Risk Factors

The SEC-mandated disclosure of every material risk the company has identified. The signal here lives in year-over-year changes — new risks added, risks re-worded or moved earlier in the list, risks quietly dropped.

Open last year's and this year's 10-K side by side. A risk that appears for the first time is usually one management is now publicly acknowledging — sometimes well after retail investors should have known about it. See our entry on Risk Factors for the diff workflow.

Item 1B-1C — Cybersecurity, Staff Comments

Item 1C (cybersecurity disclosure, mandatory since 2023) is increasingly informative — companies now describe their incident-response processes and board-level cyber oversight. Item 1B (unresolved SEC staff comments) is usually empty; when populated, read it carefully, because it means the SEC has open questions about the company's disclosure.

Items 2-4 — Properties, Legal, Mine Safety

Item 2 (real estate footprint) and Item 4 (mine safety, only relevant for extractive industries) are usually low-signal. Item 3 — Legal Proceedings — is worth scanning. Most ongoing litigation is routine; occasionally there is a case material enough to merit attention.

Item 7 — MD&A (Management's Discussion & Analysis)

The narrative the SEC requires management to write about the financial results. This is the single most useful section for understanding what happened during the year. MD&A walks through revenue drivers, margin changes, segment dynamics, capital allocation, known trends, and material uncertainties.

Watch for new line items added year-over-year — companies usually start describing something only when it has become material enough to require disclosure. A sudden new MD&A subsection on "AI infrastructure costs" or "customer attrition" is the company telling you these are now material.

Item 7A — Market Risk

Disclosure of exposures to interest rates, currencies, commodities, and equity prices. For financial firms and capital-intensive businesses this section can be material; for most other companies it is short and routine.

Item 8 — Financial Statements

The audited financials: income statement, balance sheet, cash flow statement, statement of stockholders' equity, and the notes. The notes are often longer than the statements themselves and contain critical detail: revenue recognition policies, segment results, debt covenants, lease maturities, stock-based compensation, tax reconciliation, and contingencies.

Cross-check headline numbers from the earnings release (an 8-K) against the 10-K. Sometimes non-GAAP measures in the press release are adjusted differently than what you see here.

Item 9A — Controls and Procedures

The SOX 404 conclusion: whether management considers internal controls effective, and whether the auditor agrees. A clean conclusion is normal. If you see a material weakness, the company is essentially admitting its reported financials cannot be fully relied on. Read the remediation plan carefully — single-year material weaknesses are usually recoverable; multi-year ones signal structural issues.

Items 10-14 — Governance, Compensation

Director and officer information, including details on executive compensation. Most companies incorporate these items by reference to the DEF 14A proxy statement, so the 10-K itself contains only short summaries; the detail lives in the proxy.

Item 15 — Exhibits

The list of attached documents — articles of incorporation, key contracts, subsidiaries, SOX certifications. The interesting exhibits are usually the newly-filed material contracts, which give you the actual text of important agreements (customer contracts, credit facilities, employment agreements).

The 15-minute read

For a company you already follow, a focused 15-minute scan beats no read at all by a wide margin. Here is the routine:

1. 2 min— Open last year's and this year's Risk Factors. Note any additions, deletions, or major rewordings.
2. 6 min— Read MD&A. Focus on the segment commentary and any new subsections that didn't exist last year.
3. 3 min — Skim the income statement and cash flow statement. Cross-check against any non-GAAP earnings-release numbers you previously saw.
4. 2 min — Check Item 9A for any control weaknesses.
5. 2 min — Skim the exhibits list for any newly-filed material contracts.

Anything that stood out in those 15 minutes deserves a deeper look — and usually points to a specific section of the 10-K or a related filing (8-K, DEF 14A) that contains the rest of the story.

Five 10-K red flags worth knowing

1. A new material weakness in Item 9A. Internal-controls issues correlate strongly with future restatements.
2. Risk factors that disappear quietly. A risk being removed without explanation is sometimes resolved, sometimes simply inconvenient to disclose.
3. A new MD&A subsection on a previously-not-disclosed issue. Management is now publicly acknowledging something it could no longer justify burying.
4. An expanded set of non-GAAP adjustments.If a "one-time" adjustment is back this year and last, it isn't one-time.
5. Going concern language.Any phrase suggesting "substantial doubt about the company's ability to continue as a going concern" is severe — usually preceded by months of clues in earlier 8-Ks and 10-Qs.

Frequently asked questions

Related glossary terms

• 10-k
• md-a
• risk-factors
• earnings-release
• forward-looking-statements
• non-gaap
• executive-compensation
• internal-controls
• material-weakness
• restatement
• nt-10-k
• 8-k