Disclosure Committee Charter: 2026 Practitioner Guide

Disclosure Committee Charter: 2026 Practitioner Guide

If your disclosure committee charter was drafted in 2003 and hasn't been touched since, it's not just outdated, it's a liability. The SEC's cybersecurity rules, climate disclosure requirements, and heightened scrutiny of AI-related disclosures have fundamentally expanded what a disclosure committee must govern. This guide walks through how to build or update a charter that actually works in 2026.

Key takeaway: A disclosure committee charter is the governing document that defines who reviews your public disclosures, how materiality decisions get made, and how that work supports your CEO and CFO's personal certifications under SOX Section 302. Getting it right is not optional.

Why the Disclosure Committee Exists: The SOX 302 Foundation

The disclosure committee exists because your CEO and CFO are personally on the hook for every disclosure. SOX Section 302 requires both officers to certify in each 10-K and 10-Q that they have evaluated the company's disclosure controls and procedures (DC&P) and disclosed their conclusions about effectiveness. That's a minimum of four certification cycles per year for quarterly filers, plus additional cycles for registration statements and material 8-K filings.

The SEC made the connection explicit in Release No. 33-8124 (August 2002), the adopting release for Rules 13a-15 and 15d-15:

"We believe that many companies will find it useful to form a committee of persons within the company to assist the certifying officers in making the required evaluations. Such a committee might include, for example, the principal accounting officer, the general counsel, the principal risk officer, the chief information officer and other members of senior management."

The committee is not legally mandated by name under any SEC rule or SOX provision. But it has become the de facto standard at virtually all mid-to-large U.S. public companies because without it, the CEO and CFO have no documented, systematic process to support their certifications. That's the real risk.

Rule 13a-15 defines DC&P as controls designed to ensure that required information is "recorded, processed, summarized and reported, within the time periods specified in the Commission's rules and forms" and that it is "accumulated and communicated to management, including the CEO and CFO, to allow timely decisions regarding required disclosure." The charter operationalizes that definition.

One distinction worth nailing down: DC&P is broader than internal control over financial reporting (ICFR). DC&P covers all public disclosures, not just financial statements. The disclosure committee owns DC&P; the SOX 404 process governs ICFR. The SEC's 2003 interpretive release (Release No. 33-8238) clarified this boundary, and your charter should reflect it.

What the Charter Must Cover: Section by Section

A well-drafted disclosure committee charter has seven core components. Here's what each one needs to do, and where most charters fall short.

1. Purpose Statement

The purpose clause should do two things: state the company's disclosure policy and anchor the committee's mandate to the CEO/CFO certification obligation. The BGSF charter is a clean model: "It is the Company's policy that all public disclosure made by the Company should be accurate and complete, fairly present in all material respects the Company's financial condition and results of operations, and be made on a timely basis."

That's the floor. In 2026, the purpose clause should also reference the committee's role in supporting compliance with the SEC's cybersecurity disclosure rules and sustainability reporting obligations.

2. Scope of "Disclosure Statements"

This is where most outdated charters fail. A narrow scope definition, covering only SEC filings, leaves significant disclosure risk unmanaged. The definition should explicitly cover:

• Periodic and current reports (10-K, 10-Q, 8-K), proxy statements, registration statements
• Press releases with financial information, earnings guidance, or material transaction information
• Earnings call scripts and investor presentations
• Correspondence broadly disseminated to shareholders
• Website disclosures and social media posts containing material information (see the SEC's 2013 guidance following the Netflix/Reed Hastings matter, which established that material information on social media can satisfy Regulation FD)
• ESG and sustainability reports
• Cybersecurity incident disclosures
• Non-GAAP financial measure presentations

For Regulation FD compliance, the charter should specify that earnings call scripts, analyst meeting materials, and investor day presentations are reviewed before use. For more on Reg FD mechanics, see Reg FD: Meaning, Mechanics, and 2026 Compliance Playbook.

3. Membership

Best-practice membership for 2026 looks like this:

The PwC Governance Insights Center flags that finance-only committees are a structural weakness. A joint EY/Society for Corporate Governance/FEI report found that member roles span, on average, more than 10 different job functions at companies with mature disclosure committees. If your CISO and CSO are not at the table, your charter has a gap that the SEC's 2023 and 2024 rules have made material.

4. Responsibilities and the Materiality Determination Process

The responsibilities section is the operational core of the charter, and the materiality determination process is its most critical, and most underspecified, element.

The committee should serve as the central forum where information from across the business is evaluated against the SEC's materiality standard: whether there is a substantial likelihood that a reasonable investor would consider the information important. The charter should specify:

1. Who surfaces potential material information. Business unit leaders, legal, finance, and the CISO should all have defined escalation paths to the committee.
2. How it reaches the committee. Is there a standing agenda item? A written submission process? An email protocol for urgent matters?
3. How the committee documents its conclusions. Written minutes or a decision memo for each materiality determination, signed by the chair.
4. The escalation path for disagreements. If committee members disagree on materiality, who has the deciding vote, and when does it go to the CEO/CFO directly?

For a deeper treatment of the SEC's materiality standard itself, see What's Material? The SEC's Most Important and Confusing Concept Explained.

The SEC Staff has noted in comment letters that DC&P must be designed to capture information from all relevant parts of the organization, including subsidiaries, joint ventures, and off-balance-sheet arrangements. A charter that limits the committee's access to the parent company alone is inadequate.

Other core responsibilities to specify:

• Designing, maintaining, and evaluating DC&P effectiveness at each 10-K and 10-Q period
• Reviewing non-GAAP financial measure presentations for compliance with Regulation G and Item 10(e) of Regulation S-K (a frequent SEC comment letter target)
• Reviewing insider trading policy disclosures and 10b5-1 plan adoption/modification disclosures required under the 2022 Rule 10b5-1 amendments
• Reviewing pay versus performance disclosures in proxy statements, required for fiscal years ending on or after December 16, 2022, under Release No. 33-11126

5. The Upward Certification to the CEO and CFO

The committee's written certification to the CEO and CFO, delivered before each 10-K and 10-Q filing, is the formal link between the committee's work and the officers' SOX 302 certification. This is the document that makes the committee's existence legally meaningful.

The charter should specify that the certification covers:

• The committee's conclusions on DC&P effectiveness
• Any significant deficiencies or material weaknesses identified
• Any changes in DC&P during the period
• Any other matters the officers request

This certification must be in writing. If it's not documented, it didn't happen from an enforcement standpoint. For context on what happens when disclosure controls fail, see Material Weakness Disclosure and SEC Enforcement in 2026: What CFOs Must Know.

6. Relationship to the Audit Committee

The Audit Committee and the Disclosure Committee are distinct bodies with overlapping interests. The Audit Committee is a board-level body that oversees financial reporting integrity, internal controls, and the external audit. The Disclosure Committee is a management-level body that operationally manages the preparation and review of disclosure documents.

Best practice requires a formal liaison between the two. The BGSF charter explicitly designates one committee member as the Audit Committee liaison, responsible for ensuring that disclosure concerns flow in both directions. The EY/SCG/FEI report found that approximately one-third of disclosure committee representatives regularly report to audit committees, suggesting this connection is still underdeveloped at many companies.

7. Access Rights, Meeting Frequency, and Annual Review

The charter should state that the committee has full access to all company books, records, facilities, and personnel, including the Board, Audit Committee, internal auditors, independent auditors, and internal and outside counsel.

On meeting frequency: Deloitte's governance resources recommend at least quarterly meetings aligned with the periodic reporting calendar, plus ad hoc meetings for material events. The charter should specify minimum frequency and the process for convening emergency meetings, particularly for cybersecurity incidents.

Annual review is a standard provision in virtually all model charters, but in practice many companies skip it. Given the pace of regulatory change since 2022, skipping the annual review is no longer a theoretical risk.

The 2026 Scope Expansion: Cyber, ESG, and AI

This is the section that most existing charters are missing entirely.

Cybersecurity Incident Disclosure

The SEC's cybersecurity disclosure rules (Release No. 33-11216, effective December 18, 2023) require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality. That four-business-day clock starts when the company makes the materiality determination, not when the incident occurs.

This creates a hard deadline that the disclosure committee's materiality determination process must be able to meet. A charter that requires the full committee to convene before any 8-K is filed will fail in a real incident. The fix is a sub-committee mechanism.

The Cyber Supply Inc. charter filed on EDGAR includes exactly this provision: the committee may designate two or more individuals, at least one knowledgeable about financial reporting and another about law, who can act when time does not permit full committee review. Every 2026 charter should include this, with the CISO explicitly in the loop for the initial incident assessment.

The cybersecurity rules also require annual 10-K disclosure of the company's cybersecurity risk management, strategy, and governance. The charter should assign the committee responsibility for preparing and reviewing these annual disclosures.

ESG and Climate Disclosures

The SEC's climate disclosure rules (Release No. 33-11275, adopted March 6, 2024) are subject to a voluntary stay pending judicial review, but many large companies are preparing for compliance given the likelihood of eventual implementation. Even under the stay, the disclosure committee charter should address who owns climate and ESG disclosure review.

For companies with international operations, the scope is wider:

• ISSB S1 and S2 (effective for annual periods beginning on or after January 1, 2024) are being adopted or referenced in over 20 jurisdictions. Multinational companies need the charter to address ISSB-aligned sustainability disclosures.
• EU CSRD began phasing in from fiscal year 2024 for large EU public-interest entities, with broader scope companies phasing in through 2026 to 2028. U.S. parent companies of in-scope EU subsidiaries face indirect CSRD obligations under the European Sustainability Reporting Standards.

The most common structural failure: ESG disclosures are siloed in a sustainability team with no formal connection to the disclosure committee. The charter should explicitly bring ESG/sustainability reports within the definition of Disclosure Statements and assign the CSO or Head of ESG a seat at the table.

AI-Related Disclosures

The SEC has issued guidance and comment letters signaling heightened scrutiny of AI-related disclosures, covering both companies' use of AI in operations and AI-related risk factors. The disclosure committee charter should specify a process for evaluating whether AI use in operations or financial reporting requires disclosure, and for verifying the accuracy of AI-related claims in public filings before they go out.

For the governance implications of AI in financial reporting specifically, see AI Financial Disclosure Review Framework for Audit Committees: 2026 Walkthrough and SEC Liability for AI-Generated Financial Disclosures: 2026 Enforcement Reality.

Should the Charter Be Public or Internal?

Neither SEC rules nor any exchange listing standard requires companies to post their disclosure committee charter publicly. But many companies, including BGSF, do post it on their investor relations website alongside their audit committee and compensation committee charters. This is consistent with good governance practice and investor expectations around transparency.

If you post it publicly, the charter becomes a commitment you're accountable to. That's a reason to make sure it's current before it goes up, not a reason to keep it hidden.

For companies preparing for an IPO, establishing disclosure committee governance before the S-1 is filed is essential. The disclosure committee's evaluation of DC&P effectiveness will be referenced in the CEO/CFO certifications from the first periodic report after effectiveness. See S-1 Filing: A 2026 Practitioner Walkthrough for the broader IPO disclosure framework.

Common Charter Weaknesses: A Diagnostic Checklist

Use this to benchmark your existing charter:

• Scope definition covers social media, earnings call scripts, ESG reports, and cybersecurity disclosures, not just SEC filings
• CISO is a named member or standing invitee
• CSO or Head of ESG is a named member or standing invitee
• Sub-committee mechanism exists for urgent disclosures (cybersecurity 8-K, M&A announcements)
• Materiality determination process is documented: escalation path, decision memo requirement, chair sign-off
• Non-GAAP financial measure review is an explicit responsibility
• Regulation FD compliance review of earnings call scripts and investor presentations is specified
• Upward certification to CEO/CFO is in writing and covers DC&P effectiveness conclusions
• Audit Committee liaison is a designated role
• Annual charter review is performed (not just required on paper)
• Charter addresses ISSB S1/S2 and CSRD scope for companies with international operations
• AI disclosure evaluation process is included
• Access rights extend to subsidiaries, joint ventures, and off-balance-sheet entities

FAQ

Is a disclosure committee legally required under SOX? No. Neither SOX nor any SEC rule mandates a disclosure committee by name. The SEC's Release No. 33-8124 encouraged companies to form one as a best practice to support CEO/CFO certifications under Section 302. In practice, it has become a near-universal standard because without it, the certifying officers have no documented process to rely on.

How does the disclosure committee differ from the Audit Committee? The Audit Committee is a board-level body overseeing financial reporting integrity, internal controls, and the external audit. The Disclosure Committee is a management-level body that operationally reviews and approves disclosure documents. They should communicate formally through a designated liaison, but they are separate bodies with distinct mandates.

How often should the disclosure committee meet? At minimum quarterly, aligned with the 10-K and 10-Q filing calendar. Ad hoc meetings are needed for material events: M&A announcements, cybersecurity incidents, regulatory developments. The charter should specify both the minimum frequency and the emergency convening process.

What does the committee certify to the CEO and CFO? Before each 10-K and 10-Q filing, the committee delivers a written certification covering its conclusions on DC&P effectiveness, any significant deficiencies or material weaknesses identified, any changes in DC&P during the period, and any other matters the officers request.

Where can I find real examples of disclosure committee charters? Several are publicly available. The BGSF charter is a clean mid-market example. The Cyber Supply Inc. charter on EDGAR includes a COSO-based control framework and a sub-committee mechanism. EDGAR's full-text search returns numerous additional examples filed as exhibits.

Do we need to update our charter for the SEC's cybersecurity rules? Yes, if your charter predates December 18, 2023. The four-business-day 8-K materiality determination requirement demands a rapid-response process that most pre-2023 charters do not include. Add a sub-committee mechanism, bring the CISO into the committee structure, and document the cybersecurity incident escalation path explicitly.