If you work in SEC reporting, you live inside these three forms. You know the deadlines, the sections, and the review cycles. What changes year over year is the regulatory interpretation, the SEC's current review priorities, and the tools available to do the work faster and more defensibly.
This guide is not a beginner's introduction to SEC filings. It is a current, practical reference for experienced reporting teams, covering what each form requires, where SEC staff focus their review attention, and specifically how AI is changing the workflow at each stage of the filing process.
By the end, you will have a clear picture of the requirements and deadlines for all three forms, where the most common filing gaps occur in each, and which Finrep AI agents your team can deploy at each stage of the 10-K, 10-Q, and 8-K workflow.
What Are the Three Core SEC Periodic Reporting Forms?
The three forms covered in this guide, 10-K, 10-Q, and 8-K, serve distinct disclosure functions under the Securities Exchange Act of 1934. Together they form the backbone of the continuous disclosure system that public companies in the United States are required to maintain.
The 10-K is the annual report. It provides a comprehensive picture of a company's business, financial condition, results of operations, and risk profile for the full fiscal year. The 10-Q is the quarterly report, filed for each of the first three fiscal quarters. It provides an update on financial results and material developments but is less comprehensive than the 10-K. The 8-K is the current report, filed to disclose material events as they occur, generally within four business days of the triggering event.
Each form has its own content requirements, filing deadlines, and SEC review profile. Each also has its own workflow challenges, and each is being changed by AI in different ways.
According to the SEC's Division of Corporation Finance overview, the purpose of the continuous disclosure system is to ensure that investors have access to accurate, timely, and complete information to make informed investment decisions. That purpose is what drives the SEC's review priorities across all three forms.
Part 1: The Form 10-K
What Is a 10-K and What Must It Contain?
The Form 10-K is the most comprehensive periodic report a public company files with the SEC. It covers the full fiscal year and is structured around a defined set of items that all domestic issuers must address. According to the SEC's guide to reading a 10-K, the form is organized into four main parts covering fifteen items.
Part I covers the business description, risk factors, unresolved staff comments, cybersecurity risk management, and properties. This is where the company explains what it does, what could go wrong, and how it thinks about and governs its material risks. The risk factor section in particular has grown significantly in length and complexity over the past decade as the SEC has expanded its expectations around cybersecurity, climate, and AI-related risk disclosure.
Part II covers selected financial data, MD&A (Management's Discussion and Analysis), quantitative and qualitative disclosures about market risk, the financial statements themselves, and the report of independent registered public accountants. The MD&A section is the most analytically demanding part of the 10-K. It requires management to explain the results of operations, discuss known trends and uncertainties, and provide a liquidity and capital resources analysis.
Part III covers director and officer information, executive compensation, security ownership, and corporate governance. Much of this information is incorporated by reference from the proxy statement for companies that file their proxy on time.
Part IV contains the exhibit index, including certifications from the CEO and CFO under Sections 302 and 906 of the Sarbanes-Oxley Act (SOX). These certifications make the signing officers personally accountable for the accuracy and completeness of the filing.
10-K Filing Deadlines
Filing deadlines depend on the company's filer category, which is determined by its public float:
Large Accelerated Filers (public float of $700 million or more): 60 days after fiscal year-end.
Accelerated Filers (public float between $75 million and $700 million): 75 days after fiscal year-end.
Non-Accelerated Filers and Smaller Reporting Companies: 90 days after fiscal year-end.
These deadlines apply to the filing of the complete 10-K. Companies that cannot meet the deadline may file a Form 12b-25 (Notification of Late Filing) to obtain a 15-day extension, but late filing without a 12b-25 constitutes a reporting violation. Repeated or prolonged lateness can trigger additional SEC scrutiny.
Where the SEC Focuses Its 10-K Review
The SEC's Division of Corporation Finance selects 10-K filings for full or targeted review. Full reviews are conducted on at least a three-year cycle for most registrants. Targeted reviews focus on specific items triggered by risk indicators: significant accounting changes, acquisition or restructuring activity, material restatements, cybersecurity incidents, or sharp divergence between a company's disclosure depth and what peers in the same sector are filing.
The sections that most frequently generate SEC comment letters in 10-K reviews, based on the SEC's filing review process guidance, are MD&A, non-GAAP financial measures, segment reporting, revenue recognition disclosures, and risk factors. The SEC's review of risk factors focuses specifically on whether the risks disclosed are company-specific and material, or whether they are generic boilerplate that could apply to any public company in the sector.
How AI Changes the 10-K Workflow
The 10-K workflow has historically been one of the most time-intensive processes in the CFO office. Research, benchmarking, drafting, review, and sign-off can span six to ten weeks of intensive work. AI is changing this at four specific points in that process.
Roll-Forward: The first substantive task in 10-K preparation is rolling the prior year filing into the current year template, updating dates, financial references, and boilerplate while preserving reviewer-approved language. Done manually, this takes days and introduces transcription risk. Finrep's Roll-Forward agent automates this process, updating dates, references, and standard boilerplate while flagging any prior-period language that requires a discretionary update rather than a mechanical one.
Peer Alignment: Before finalising disclosure language, most experienced reporting teams check how their peer set is addressing the same topics. Verbatim EDGAR language, coverage depth, and structural choices all inform the drafting process. Finrep's Peer Alignment agent scans your draft against your defined peer group and flags over-disclosure and under-disclosure by topic relative to current market practice, with verbatim EDGAR excerpts for each flag.
Filing Health Check: Before the filing goes out, teams need to verify that the narrative is internally consistent, that cross-references between sections are accurate, and that metric changes in the financial statements are reflected and explained in the MD&A. Finrep's Filing Health Check agent checks for narrative drift without explanation, within-filing cross-reference inconsistencies, and material metric changes that lack disclosure support.
Comment Letter Risk: Perhaps the highest-value AI application in the 10-K workflow is pre-filing comment letter risk mapping. Finrep's Comment Letter Risk agent maps your 10-K draft against historical SEC comment patterns in your sector and returns a ranked, section-level exposure list. Your team sees exactly where the risk sits before the filing goes in, not after a comment letter arrives.
Request access to Finrep's 10-K workflow agents
Part 2: The Form 10-Q
What Is a 10-Q and How Does It Differ From a 10-K?
The Form 10-Q is the quarterly interim report filed for each of the first three fiscal quarters of the year. The fourth quarter is covered by the annual 10-K rather than a separate 10-Q. The 10-Q is less comprehensive than the 10-K but subject to many of the same SEC review standards for the sections it does cover.
The core difference is scope and auditor involvement. The 10-K includes fully audited financial statements, reviewed by the independent registered public accounting firm and covered by an auditor's report. The 10-Q includes unaudited interim financial statements that are subject to the auditor's review procedures, a less intensive standard than a full audit but still a significant quality control step.
The content requirements for a 10-Q cover three main areas. Part I requires unaudited financial statements (balance sheet, income statement, cash flow statement, and notes), along with an MD&A for the quarter and the year-to-date period, and quantitative and qualitative disclosures about market risk. Part II covers legal proceedings, risk factor updates, unregistered sales of equity securities, defaults on senior securities, mine safety disclosures, and other information. Part III contains exhibits and certifications.
The MD&A in a 10-Q is focused on explaining material changes from the most recent annual period and from the comparable prior-year quarter. Teams frequently underestimate the SEC's scrutiny of quarterly MD&A because it is shorter than the annual version. The SEC reviews it with the same analytical framework: does the discussion explain the reasons behind material changes, or does it describe them?
10-Q Filing Deadlines
Large Accelerated Filers: 40 days after the end of each fiscal quarter.
Accelerated Filers: 40 days after the end of each fiscal quarter.
Non-Accelerated Filers and Smaller Reporting Companies: 45 days after the end of each fiscal quarter.
The 10-Q deadline is significantly tighter than the 10-K deadline relative to the amount of work involved. For a company with a March 31 fiscal quarter-end, a large accelerated filer must file by May 10. That 40-day window includes quarter-close, financial statement preparation, auditor review, MD&A drafting, legal review, disclosure committee review, and EDGAR submission. The compressive nature of this timeline is one of the primary reasons AI tools that reduce research and drafting time generate the most immediate value in the 10-Q cycle.
What the 10-Q Adds Beyond the 10-K
One area the 10-Q specifically requires that is often underestimated is the risk factor update obligation. Companies are required to disclose material changes to their risk factors from those previously disclosed in the most recent annual report. Many teams carry forward a generic statement that there are no material changes when in fact business developments during the quarter have created new or materially changed risks. This is a consistent SEC comment trigger.
The 10-Q also requires disclosure of any material legal proceedings not previously disclosed, any defaults on senior securities, and, critically, any material cybersecurity incidents that occurred during the quarter under the SEC's December 2023 cybersecurity disclosure rules. This last requirement is frequently missed by reporting teams who receive incident information from IT and legal but do not have a formal process for assessing materiality and triggering the reporting obligation.
How AI Changes the 10-Q Workflow
The 10-Q workflow is compressed by design. The same work as the 10-K, in roughly half the time. AI addresses this through three specific capabilities.
Cross-Period Drift Analysis: The most common 10-Q comment trigger is unexplained language shifts relative to prior periods. If your Q1 10-Q uses different language to describe your revenue recognition methodology than your most recent 10-K without explaining why, the SEC will ask about it. Finrep's Cross-Period Drift Analysis agent detects unexplained language shifts in your draft relative to prior periods and surfaces annotated diffs with suggested explanations for each material change. This replaces a manual paragraph-by-paragraph comparison that typically takes a day of analyst time.
Risk Factor Benchmark: Updating risk factors for a 10-Q requires knowing not just what changed for your company but what risk language your peers are adding in response to the same market conditions. Finrep's Risk Factor Benchmark agent scans your peer set's risk factor sections and surfaces risk categories your peers are covering that you are not, with coverage depth comparison across your entire peer group.
Redline Reporting: After the 10-Q draft is complete, the team needs to generate a tracked-changes view relative to the prior period for disclosure committee and legal review. Finrep's Redline Reporting agent generates this view automatically, annotating what changed, why it changed, and whether changes were disclosure-driven or financial. This eliminates a manual redlining step that consumes significant time at the end of an already compressed cycle.
See how Finrep accelerates the 10-Q workflow
Part 3: The Form 8-K
What Is an 8-K and When Must You File One?
The Form 8-K is the current report, used to disclose material events to investors as they occur rather than waiting for the next periodic report. The filing obligation is triggered by specific events defined in the SEC's rules, and the deadline is generally four business days from the date the triggering event occurs or becomes known to management.
The 8-K is the most operationally demanding of the three forms because it has no fixed schedule. The obligation arises when the event arises, which may be at any point in the fiscal year, often during the most inconvenient windows: during quarter-close, during board meetings, or during capital markets transactions when the SEC filing team is already stretched.
The SEC's rules identify over 20 distinct triggering events across nine item categories. Understanding which events trigger an 8-K obligation, and what the filing must contain for each, is a standing compliance requirement for every public company legal and reporting team.
The Most Commonly Triggered 8-K Items
Item 1.01: Entry into a Material Definitive Agreement Any material agreement not made in the ordinary course of business triggers an 8-K. The filing must describe the agreement's material terms. Determining materiality requires legal judgment and is often the source of delay in 8-K filings. The SEC's guidance on materiality in 8-K filings provides the framework, but the analysis is fact-specific.
Item 2.01: Completion of an Acquisition or Disposition When a company completes a significant acquisition or disposition, an 8-K is required. For acquisitions that exceed defined significance thresholds, audited financial statements of the acquired business and pro forma financial information must be filed within 71 calendar days of the initial 8-K.
Item 2.02: Results of Operations and Financial Condition This is the earnings release 8-K, filed when a company publicly discloses quarterly or annual earnings results. It is the highest-volume 8-K item for most public companies, filed four times per year. The earnings release itself and any related earnings call scripts or supplemental data are typically included as exhibits.
Item 4.02: Non-Reliance on Previously Issued Financial Statements This item is triggered when a company or its auditor concludes that previously issued financial statements should no longer be relied upon, typically due to a restatement. An Item 4.02 8-K is one of the highest-scrutiny filings a company can make and almost always triggers a full SEC review of the restated filing.
Item 5.02: Departure or Appointment of Directors and Principal Officers Any appointment or departure of a director, CEO, CFO, COO, President, or Chief Accounting Officer triggers this item. The filing must describe the circumstances of a departure if they involve a disagreement with the company.
Item 7.01 and 8.01: Regulation FD Disclosure and Other Events Item 7.01 is used to satisfy Regulation FD obligations when a company makes a selective disclosure to analysts or investors and needs to make that information public simultaneously or promptly. Item 8.01 covers any other material event the company determines requires disclosure.
Item 1.05: Material Cybersecurity Incidents Added by the SEC's December 2023 cybersecurity disclosure rules, Item 1.05 requires disclosure of any material cybersecurity incident within four business days of the company determining that the incident is material. This is the newest and most operationally complex 8-K obligation for most reporting teams, because the materiality determination must occur rapidly, under conditions of often incomplete information, while the incident response is still ongoing.
The 8-K Four-Day Deadline in Practice
The four-business-day deadline runs from when the triggering event occurs or when management becomes aware of it. For planned events like earnings releases, this is manageable. For unplanned events like cybersecurity incidents, executive departures under adversarial circumstances, or unexpected regulatory actions, the four-day window is operationally demanding.
Companies frequently use the Item 8.01 catch-all to file an 8-K for events that are material but do not fit neatly into a defined item category. The SEC's Division of Corporation Finance FAQ on 8-K obligations provides interpretive guidance on edge cases, but many materiality assessments require legal judgment that must be made quickly.
How AI Changes the 8-K Workflow
The 8-K presents a different AI use case than the 10-K or 10-Q. The challenge is not volume of work over a compressed timeline. It is speed and accuracy under conditions where the team may be dealing with a fast-moving situation and where the disclosure language must be both accurate and legally defensible from the moment it is filed.
8-K Event Disclosure Agent: Finrep's 8-K Event Disclosure agent identifies the correct 8-K items for a triggering event, drafts the narrative sections using peer precedent and prior period language, calculates the SEC filing deadline, and surfaces how comparable companies have disclosed similar events. For a team managing an unexpected executive departure at 6pm on a Thursday, this collapses hours of drafting and research into minutes.
Material Event Triage: Before drafting begins, the team needs to assess whether an event crosses the materiality threshold that triggers an 8-K obligation. Finrep's Material Event Triage agent assesses whether a specific event crosses materiality thresholds and surfaces how comparable companies have disclosed similar events. This provides a documented basis for the materiality determination, which is important for both the disclosure controls certification and any subsequent SEC review.
Peer Disclosure Evolution: For recurring 8-K events like earnings releases, the disclosure language and structure evolve over time across the peer group. Finrep's Peer Disclosure Evolution agent tracks how your peers are changing their disclosure language, depth, and tone across reporting periods, so your earnings release language reflects current market practice rather than your own prior-year template.
Request access to Finrep's 8-K workflow agents
How the Three Forms Connect: The Annual Disclosure Lifecycle
The 10-K, 10-Q, and 8-K are not independent documents. They are part of a continuous disclosure record that the SEC reads as a whole. Inconsistencies between them are a primary source of SEC comment letters.
The risk factors in your 10-K set the baseline. Your 10-Q updates must reflect material changes to those risks or explicitly state that there are no material changes. Your 8-K disclosures of specific events must be consistent with the risk language in both. If your 10-K risk factors describe your cybersecurity governance in general terms, your Item 1.05 8-K for a material cybersecurity incident will be read against that baseline, and a significant gap between what you described as your governance and what the incident reveals will generate SEC scrutiny.
The same consistency obligation applies to MD&A. The narrative explanation of your business performance must be consistent across your 10-K and 10-Q filings. If your annual MD&A describes a key driver of revenue growth, your quarterly MD&A must update that discussion as conditions change. Omitting a prior-period driver without explanation, or describing a trend differently across periods without acknowledging the change, is the most common source of MD&A comment letters across all three form types.
According to the Harvard Law School Forum on Corporate Governance, disclosure committees at leading public companies now review cross-document consistency as a standing agenda item before any periodic filing, precisely because the SEC reads the entire disclosure record, not individual filings in isolation.
Finrep's Cross-Period Consistency agent addresses this directly. It flags inconsistencies in management narrative framing, metric definitions, and disclosure language across reporting periods, surfacing divergences that require resolution or explanation before the filing is submitted.
iXBRL Tagging: The Technical Layer Across All Three Forms
All three forms require inline XBRL (iXBRL) tagging of financial data. The SEC's EDGAR system processes iXBRL tags as structured data, enabling automated review and public data analysis. Tagging errors are caught by EDGAR's automated validation system and can cause filing processing errors, generate staff review flags, or in some cases result in a comment letter about data quality and taxonomy compliance.
The most common iXBRL issues across all three form types are: use of custom elements where standard taxonomy elements exist, inconsistent element selection across periods, and incorrect scaling or sign conventions. The SEC's EDGAR Full-Text Search makes iXBRL data publicly accessible, which means your tagging choices are visible to investors, analysts, and regulators immediately upon filing.
Finrep's iXBRL Tagging agent validates iXBRL tagging against SEC taxonomy requirements, flags custom element usage, and benchmarks your tagging choices against peer filing practices. Running this before submission catches errors that would otherwise surface as EDGAR processing exceptions after filing.
The Certification Layer: What Officers Are Signing
Every 10-K and 10-Q includes certifications from the CEO and CFO under Sections 302 and 906 of the Sarbanes-Oxley Act. These certifications confirm that the signing officers have reviewed the report, that the report does not contain any materially untrue or misleading statements, and that the disclosure controls and procedures are effective.
The Section 302 certification in particular requires the CEO and CFO to confirm that they have disclosed to the audit committee and the independent auditor any significant deficiencies and material weaknesses in internal controls, and any fraud involving management or other employees with a significant role in internal controls.
This certification is what makes the disclosure controls and procedures framework consequential. A CFO who signs a Section 302 certification without a documented, systematic review of the filing's completeness, accuracy, and consistency is taking on personal legal exposure. Finrep's Certification Readiness agent produces a pre-certification risk summary covering disclosure completeness, control effectiveness status, and all outstanding open items, giving the signing officers a documented basis for their certification.
According to the PCAOB Auditing Standards, the auditor's review of interim financial information in a 10-Q and the full audit of annual financial statements in a 10-K are both conducted against the backdrop of the company's disclosure controls framework. A certification readiness process that is documented and systematic strengthens the auditor's confidence in that framework.
Frequently Asked Questions
What is the difference between a 10-K, 10-Q, and 8-K?
A 10-K is the annual report filed after fiscal year-end, containing fully audited financial statements and comprehensive business and risk disclosures. A 10-Q is the quarterly interim report filed for each of the first three fiscal quarters, containing unaudited financial statements and a more focused MD&A update. An 8-K is the current report filed within four business days of a material triggering event, such as an earnings release, executive change, or material agreement. Together the three forms constitute a company's continuous disclosure record under the Securities Exchange Act of 1934.
What are the filing deadlines for 10-K and 10-Q?
For large accelerated filers (public float of $700 million or more), the 10-K is due 60 days after fiscal year-end and the 10-Q is due 40 days after each fiscal quarter-end. For accelerated filers, the 10-K is due 75 days after fiscal year-end and the 10-Q is due 40 days. Non-accelerated filers and smaller reporting companies have 90 days for the 10-K and 45 days for the 10-Q. Companies that cannot meet the deadline may file a Form 12b-25 for a 15-day extension on the 10-K or a 5-day extension on the 10-Q.
What triggers an 8-K filing obligation?
An 8-K is triggered by specific material events defined in the SEC's rules, including entry into a material definitive agreement, completion of an acquisition or disposition, quarterly or annual earnings results, executive appointments or departures, non-reliance on previously issued financial statements, and material cybersecurity incidents. The deadline is generally four business days from when the event occurs or when management becomes aware of it. The SEC's Division of Corporation Finance provides interpretive guidance on edge cases and materiality determinations.
How does AI help with SEC form preparation?
AI tools built specifically for SEC reporting, such as Finrep's 40 purpose-built AI agents, reduce time on the most labour-intensive parts of the filing workflow: rolling forward prior period language, benchmarking peer disclosures, mapping draft content against SEC comment letter history, detecting cross-period language drift, and generating redlines for review. The key distinction from general AI tools is that purpose-built SEC reporting AI grounds every output in cited, auditor-traceable sources, including ASC guidance, peer EDGAR filings, and SEC correspondence, rather than generating uncited text that cannot be verified.
What is the most common reason the SEC issues comment letters on 10-K and 10-Q filings?
Based on the SEC's filing review process and PwC's guide to the SEC comment letter process, the most common triggers are MD&A sections that describe results without explaining the underlying business reasons, non-GAAP financial measures that are not presented with equal GAAP prominence or have incomplete reconciliations, segment reporting structures that do not clearly reflect how the CODM manages the business, and risk factors that are generic rather than company-specific. Consistency failures across periods, where the narrative changes without explanation, are also a persistent source of comment letter activity across all three form types.
What is iXBRL and why does it matter for 10-K, 10-Q, and 8-K filings?
Inline XBRL (iXBRL) is the structured data tagging format the SEC requires for financial statements in 10-K and 10-Q filings. It embeds machine-readable tags directly into the filing document, allowing the SEC's EDGAR system and the public to access financial data as structured information rather than text. Tagging errors, including use of incorrect taxonomy elements, inconsistent element selection across periods, or wrong scaling conventions, can cause EDGAR processing exceptions, generate SEC staff review flags, or result in comment letters about data quality.
Key Takeaways
- The 10-K, 10-Q, and 8-K serve distinct disclosure functions and have different content requirements, deadlines, and SEC review profiles. Understanding the differences is the foundation of an effective periodic reporting programme.
- Filing deadlines are tighter than they appear relative to the work involved. A 40-day 10-Q window that includes quarter-close, auditor review, disclosure committee sign-off, and EDGAR submission leaves almost no margin for research and drafting delays.
- The SEC reads your entire disclosure record, not individual filings in isolation. Cross-document consistency across the 10-K, 10-Q, and 8-K is a standing review standard and a primary comment letter trigger.
- AI tools purpose-built for SEC reporting, including roll-forward, peer alignment, cross-period drift detection, comment letter risk mapping, and certification readiness agents, reduce the most time-intensive parts of all three workflows without sacrificing the citability and audit-readiness that public company disclosures require.
- iXBRL tagging and SOX certifications are technical and legal layers that apply across all three forms and require systematic, documented processes, not last-minute checks.
Ready to see how Finrep's AI agents work across the 10-K, 10-Q, and 8-K workflow? Request access here.
Finrep is an AI-powered financial disclosure intelligence platform for the Office of the CFO. 40 purpose-built AI agents for SEC reporting, technical accounting, investor relations, legal counsel, and disclosure committee functions. SOC2 Type II and ISO 27001 certified. Zero data residency. Backed by Accel. Trusted by CFO teams at FOX, Roku, HP, RingCentral, Wells Fargo, and Infosys.
For further reading, see how Finrep compares to Intelligize for EDGAR research and financial disclosure benchmarking and the Section 16 deadline guide for Foreign Private Issuers.
