As we do each year, we offer our observations on new developments and recommended practices to consider in preparing the Annual Report on Form 10‑K. In particular, given the U.S. Securities and Exchange Commission's (the "SEC") latest enforcement actions and recent adoption of amendments impacting disclosures in Form 10‑K,1 there are a number of important substantive and technical considerations that registrants should keep in mind when preparing their 2019 Forms 10‑K.

I. Substantive Considerations

A. Management's Discussion & Analysis

As discussed in our prior client alert,2 registrants that provide financial statements covering three years in their public filings are no longer required to include in the Management's Discussion and Analysis ("MD&A") section a discussion of the earliest year if: (i) such discussion was already included in any other of the registrant's prior filings that required compliance with Item 303 of Regulation S‑K; and (ii) registrants identify the location in the prior filing where the omitted discussion can be found. For example, when a registrant files its 2019 Form 10‑K with financial statements for fiscal years 2017, 2018, and 2019, the registrant can omit from its MD&A the discussion comparing its operating results and financial condition for fiscal year 2017 (typically presented as a comparison of 2018 to 2017), and instead only discuss its operating results and financial condition for fiscal years 2018 and 2019 and refer the reader to the MD&A in the 2018 Form 10‑K where the 2017 discussion may be found. The registrant may refer to any filing with the SEC that included a 2017 discussion pursuant to Item 303 of Regulation S‑K, which could be an initial public offering ("IPO") registration statement, a Form 10 for a spin-off, or a variety of other filings.

To date, many companies are not taking advantage of this rule change. As of December 31, 2019, of the 91 S&P 500 companies that have filed a Form 10‑K since these MD&A changes went into effect in April 2019, 52 companies (57%) discussed three years of financial information (including a comparative discussion between 2017 and 2018) in the MD&A, while 39 (43%) companies omitted the comparative discussion of the third year,3 although 14 of these companies4 (15%) included charts or tables in the MD&A that set forth three years of financial information but omitted a comparative discussion between 2017 and 2018.5 Generally, the larger S&P 500 companies we looked at have chosen not to omit discussion of the earliest of the three years from the MD&A. Of the 23 companies with market capitalizations over $50 billion that have filed Forms 10‑K since the change went into effect: 14 companies provided and discussed three years of financial information in the MD&A; five companies6 provided three years of financial information, but omitted a comparative discussion between 2017 and 2018; and four companies7 took full advantage of the new rules and provided and discussed only the two most recent years of financial information in the MD&A. The instruction requires registrants to disclose the location of the prior discussion, but does not require that the prior discussion be incorporated by reference or hyperlinked. Most registrants have tended to include the statement identifying the location of the prior disclosure at the beginning of the MD&A, the beginning of the Results of Operation section, or the end of the Results of Operation section.

Regardless of whether discussing three years or only two years in the MD&A, registrants should remain mindful of the need to review their discussion of the earlier years to determine whether anything has come to light since the time of the original disclosure that would make the original disclosure incomplete or inaccurate to an extent that would be material. For example: Are there material trends that were not manifest at the time of the original disclosure that are now known and would be important to understanding the results of operations and financial condition of the registrant? Are there forward-looking statements that were made in the discussion of results of operations and financial condition for the earliest year that have subsequently been proven to be inaccurate? Have any material operations been discontinued? Have any accounting changes taken effect that would make the discussion from the earliest year materially inaccurate or incomplete? At the risk of stating the obvious, registrants who determine to discuss all three years in their MD&A should not simply restate their prior disclosures if doing so would result in a material misstatement or omission. If a registrant has determined to address only the most recent two years in its MD&A but determines it advisable to comment on an aspect of its third-year financial results, it often may be able to do so without repeating the entire MD&A discussion covering its third-year results.

B. Prepare for Critical Audit Matter Disclosures in Auditor's Report

For large accelerated filers whose fiscal year ends December 31, the 2019 Form 10‑K filing will be the first annual filing that will require the registrant's auditor to include new disclosures in its audit report about critical audit matters ("CAMs") that the auditor identifies during the course of the audit.8 The audit standard, AS 3101,9 requires that for each CAM communicated in the auditor's report, the auditor must: (i) identify the CAM; (ii) describe the principal considerations that led the auditor to determine that the matter is a CAM; (iii) describe how the CAM was addressed in the audit; and (iv) refer to the relevant financial statement accounts or disclosures that relate to the CAM. Despite the Public Company Accounting Oversight Board's ("PCAOB") instruction that CAMs be highly tailored and avoid boilerplate, based on the CAMs that have been published to date, it appears that audit firms are developing somewhat standardized language for certain types of CAMs. As reflected in guidance from the PCAOB, it is expected that one or more CAMs will be identified in connection with each audit.10 As noted in our previous client alert, registrants should engage with their auditors to avoid unwelcomed surprises when the Form 10‑K filing deadline nears.11 For example, registrants should consider possible scenarios where the new standard might put the auditor in a position of having to make disclosures of original information, and prepare in advance for how to address such situations. Since CAMs will typically address a topic that also is discussed in financial footnotes or MD&A, registrants should make sure that their language is consistent with the discussion in the CAM.

C. Review Risk Factors with a Focus on Disclosure of Hypothetical Events

In the past year, the SEC announced two enforcement cases in which it alleged that statements in a company's risk factors were materially misleading. In both cases, the SEC focused on statements that phrased an event or contingency as a hypothetical, and alleged that at the time of the disclosure the situation was no longer hypothetical (regardless of whether it was clear at the time that there would be a material consequence). For example, in SEC v Mylan NV,12 the SEC alleged that the statement, "a governmental authority may take a position contrary to a position we have taken, and may impose or pursue civil and/or criminal sanctions" was materially misleading since at the time a government agency had informed Mylan that it believed Mylan was misclassifying EpiPen as a generic drug, a position that Mylan was disputing. The SEC claimed that "Instead of disclosing that [the government agency] disagreed with Mylan's classification of EpiPen, Mylan misleadingly presented a potential risk that [an agency] could disagree" and that Mylan's "hypothetical phrasing created the impression that [the government agency] had not yet taken a position on Mylan's classification of EpiPen." In announcing an earlier similar enforcement case, the SEC's press release stated that public companies' disclosures must be "accurate in all material respects, including not continuing to describe a risk as hypothetical when it has in fact happened."13

These settlements indicate that risk factor disclosure should be revisited regularly and treated as "living" as much as the rest of the filing, including the MD&A. Registrants should thoroughly review their risk factor disclosures in their upcoming Form 10‑K so that the disclosures do not speak about events hypothetically (g., "could" or "may") if those events have occurred or are occurring. If a risk has manifested itself, that factual event should be appropriately reflected in the body of the risk factors. Registrants should be careful with how they describe significant events (e.g., material cyber breaches, material events impacting operating results) as well as more routine items (e.g., fluctuations in demand, inventory write-downs, customer reimbursement claims, intellectual property claims, poorly performing investments, and tax audits). If a risk involves a situation that arises from time to time, then it may be preferable to refer to the consequences of such situation as a material contingency, instead of referring to the situation as a hypothetical contingency.

D. Review Substantive Content of Risk Factors

Registrants should also make sure the content of their risk factors is up to date and reflects risks presented by current events and conditions. There are a few areas in particular about which the SEC has stated that it expects to see risk disclosures.

  • Intellectual Property and Technology Risks Associated with Foreign Operations. On December 19, 2019, the Division of Corporation Finance (the "Division") of the SEC released CF Disclosure Guidance: Topic No. 8 (Intellectual Property and Technology Risks Associated with International Business), which reminds registrants of their risk disclosure obligations in light of the wide array of evolving risks stemming from the global and technologically interconnected nature of today's business environment.14 Registrants, particularly those that conduct business in certain foreign jurisdictions, house technology, data, and intellectual property abroad, or license technology to joint ventures with foreign partners, should review the guidance, including the list of questions it poses to help registrants assess the sufficiency of their disclosures regarding these type of risks.
  • Environmental Risks. The SEC remarked in late 2018 that investors are continuing to increase their focus on the "long-term investment risks and benefits associated with" environmental, social and governance ("ESG") matters. To address this growing investor appetite, registrants have added disclosures in the risk factors section of their Forms 10‑K to address ESG matters. A 2019 study by the National Association of Corporate Directors showed that 66% of companies in the Russell 3000 Index discussed ESG risk, including, among other factors, climate change and water scarcity risks.15 Given the increase in ESG disclosures by registrants, the SEC has followed suit by beginning to pay particular attention to the substance and presence of such disclosures, which registrants should keep in mind when addressing ESG risk factors in their Forms 10‑K.16
  • Privacy-Related Risks. With the enactment of the California Consumer Protection Act ("CCPA"), which went into effect on January 1, 2020, the SEC revitalized its focus on privacy-related risks. Indeed, the World Privacy Forum recently advised the SEC that most registrants face some type of data privacy risk today, likening data privacy risk's importance to that of environmental risks.17 Given the public discourse regarding data privacy risks along with recent legislative enactments, registrants should review their privacy-related risk factors and disclose material data privacy risks, including risks associated with the CCPA, and re-evaluate any disclosures or risks associated with the EU General Data Protection Regulation.
  • LIBOR Transition Risks. In July 2019, the SEC issued a statement regarding the expected cessation of LIBOR after December 31, 2021.18 The industries most likely to be impacted by the discontinuation of LIBOR include real estate, banking and insurance industries. The SEC noted that registrants should review their risk factor disclosures related to the expected discontinuation of LIBOR. To date, however, we have seen relatively few risk factors addressing LIBOR transition risks. In addition to a general review of financing and hedging arrangements that may reference LIBOR, registrants should evaluate whether significant commercial relationships have LIBOR-related terms. Registrants also should consider the fact that the cessation of LIBOR may take place over several reporting periods, which means that it may be appropriate to address in MD&A liquidity discussions any mitigating steps they have taken to date as well as addressing risks from any remaining exposures.
  • International Trade Risks. As the international trade climate remains fluid, the SEC has increased its focus on sanctions disclosures in registrants' public filings. The Wall Street Journal noted that at least 42 public companies received comment letters from the SEC in 2018 regarding their business activity in areas subject to sanctions.19 More recently, the SEC sent comment letters to QUALCOMM Inc.20 and Paypal Holdings Inc.21 regarding their sanctions-related disclosures. Registrants should consider their activities in areas subject to sanctions and review their related risk factor disclosures to ensure such risks are accounted for and adequately described.
  • Brexit-Related Risks. As mentioned by Division Director Bill Hinman in March 2019, registrants should consider whether Brexit exposes them to risks such as those associated with the application of new or different regulatory schemes, supply chain disruptions, customer loss, and currency exchange rate fluctuations. Registrants also should review existing material contracts for contractual risk and consider financial statement impacts such as inventory write-downs, long-lived asset impairments, and assumptions underlying fair value measurements.22
  • Cybersecurity Risks. In February 2018, the SEC issued guidance regarding registrants' cybersecurity disclosures in their public filings.23 In particular, the SEC emphasized that registrants should (i) consider the materiality of cybersecurity risks, (ii) avoid boilerplate language regarding such risk, and (iii) focus on timely disclosures when a registrant becomes aware of a cybersecurity incident or risk. In addition, the SEC noted that registrants have a duty to correct and update any prior disclosure that the registrant determines was untrue or omitted necessary material facts that would otherwise make the disclosure misleading.
  • Industry-Specific Risks. Registrants should be mindful of unique risks presented to the industry or industries in which they operate, whether those arise from political developments, commodity prices, competitive dynamics, regulatory changes, international events or some other source.

E. Consider Whether Ongoing Governmental Investigations Require Accrual or Disclosure

Registrants are reminded to consider any ongoing governmental investigations or lawsuits concerning the registrant and whether an investigation or lawsuit may require accrual or disclosure under Accounting Standard Codification 450 ("ASC 450") in light of the Mylan24 In the fall of 2014, the Department of Justice ("DOJ") began investigating Mylan for claims under the False Claims Act. As the DOJ's investigation continued to gain traction, Mylan did not disclose the existence of the investigation and did not accrue any amount for the potential loss until Mylan announced that it had settled the matter in October 2016 for $465 million.

As alleged in the SEC's complaint, pursuant to ASC 450, public companies facing possible material losses from a lawsuit or government investigation must (i) disclose the loss contingency if a loss is reasonably possible and (ii) record an accrual for the estimated loss if the loss is probable and reasonably estimable. Mylan, however, failed to disclose or accrue for the loss relating to the DOJ investigation despite the investigation continuing to gain traction over the two-year period. As a result, Mylan agreed to pay $30 million to settle charges that its public filings were false and misleading due to its failure to include timely disclosure regarding the DOJ's investigation.

The Mylan case serves as an important reminder that registrants must continually monitor the facts surrounding governmental investigations and lawsuits to evaluate material business risks and timely disclose and account for loss contingencies that can materially affect their financial condition or results of operations.

F. Review Description of Property

The SEC's amendments to Item 102 of Regulation S‑K provide that registrants are now only required to describe a physical property to the extent the property is material to such registrant's business, which contrasts with the previous requirement to disclose "principal" plants, mines, and other "materially important" physical properties.25 Revisions to Item 102 also clarify that it may be appropriate to provide property disclosures on a collective basis rather than on an individual basis. This presents registrants with a good opportunity to revisit some disclosures that may have remained static for several years.

G. Consider Impact of New Accounting Standard for Current Expected Credit Loss ("CECL")

In November 2019, the SEC's Office of the Chief Accountant ("OCA") and the Divisions of Corporation Finance ("CF") issued a staff accounting bulletin, SAB 119, to align certain portions of prior staff interpretative guidance with the relevant concepts of the Financial Accounting Standards Board ("FASB") new expected credit loss standard for registrants engaged in lending activities.26 As noted in SAB 119, OCA and CF staff believe many of the concepts from SAB 102 continue to be relevant under the expected credit loss model. Applicable registrants should consider the new guidance and be prepared to disclose appropriate implementation-related disclosures, including regarding the sufficiency of their controls over allowances for credit losses, in the event this accounting standard is adopted. Further, as calendar-year filers generally were required to adopt the new accounting standard for CECL on January 1, 2020, these registrants, per SAB 78, should discuss progress toward implementation of the new standard and the expected effects of adoption, particularly if implementation of this new standard is expected to be material.

H. Revisit Prior Language to Remove Immaterial Information

Over the years, registrants' annual reports tend to accumulate disclosures that were added for a specific reason, but no longer convey material information. For example, disclosure may have been added to address old comment letters from the SEC or events that had a material impact on the registrant at a time in the past when circumstances were different. In speeches and other venues, SEC officials and staff have encouraged registrants to take a hard look at their filings to determine whether disclosures are still material in light of the registrant's current situation.

II. Technical Rule Changes

A. Cover Page

As discussed previously in our Securities Regulation and Corporate Governance Monitor,27 registrants should update the cover page of their upcoming Form 10‑K to accurately reflect the SEC's recently announced Form 10‑K cover page changes:28

  • Interactive Data Files. With the SEC eliminating the requirement that Interactive Data Files be posted on a registrant's website, the 2019 Form 10‑K cover page should likewise remove any reference to "posting" Interactive Data Files on the Company's website.
  • Trading Symbol. The registrant must now disclose on its Form 10‑K cover page its trading symbol on the applicable public stock exchange (e.g., Nasdaq or NYSE) for each security registered pursuant to Section 12(b) of the Exchange Act, including any preferred stock or debt that is Section 12(b) registered.
  • Section 16(a) Delinquencies. In light of the SEC's amendments to Item 405 relating to Section 16 reporting, the SEC eliminated the requirement to include the checkbox on the cover page of Form 10‑K relating to Section 16(a) delinquencies.
  • Smaller Reporting Company Parenthetical. As discussed previously in our Securities Regulation and Corporate Governance Monitor, due to the recent change in the definition of "smaller reporting company," the SEC removed the parenthetical on Form 10‑K cover pages that states "(do not check if smaller reporting company)" under Non-accelerated filer.29

B. Section 16 Compliance

While disclosures about Section 16 reporting delinquencies are typically included in a registrant's proxy statement and incorporated by reference in their Forms 10‑K, it is still important to note the impact of the SEC's amendments to Item 405, particularly where the Form 10‑K references the sections of the proxy statement that is incorporated by reference. The SEC's amendments require that registrants change the disclosure heading required by Item 405(a)(1) from "Section 16(a) Beneficial Ownership Reporting Compliance" to "Delinquent Section 16(a) Reports." Under the new instructions to Item 405, registrants are encouraged to exclude that heading altogether if there are no reportable Section 16(a) delinquencies.

C. Exhibit-Related Items

The SEC also adopted amendments that impact the technical disclosure requirements concerning exhibits.

To view the full article please click here.

Footnotes

1 Available at https://www.sec.gov/rules/final/2019/33-10618.pdf.

2 Available at https://www.gibsondunn.com/sec-continues-to-modernize-and-simplify-disclosure-requirements.

3 For ease of reference, these statistics refer to issuers with fiscal years ending in 2019 as providing financial statements covering fiscal years 2017, 2018, and 2019. Further, references to the third year refer to fiscal year 2017.

4 Such companies are Analog Devices Inc., Apple Inc., Atmos Energy Corp., Cisco Systems, Coty Inc., Estee Lauder Companies Inc., Maxim Integrated Products, Inc., Oracle Corp., Raymond James Financial Inc., Skyworks Solutions, TransDigm Group Inc., Varian Medical Systems Inc., Walgreens Boots Alliance, Inc., and Western Digital Corp.

5 The 25 companies that included only two years of financial information and a comparative discussion between 2017 and 2018 in their MD&A are ABIOMED, Inc., Air Products & Chemicals, Inc., Broadridge Financial Solutions, Inc., Cooper Companies, Inc., D.R. Horton Inc., Darden Restaurants, Inc., Deere & Co., DXT Technology Co., Inc., Electronic Arts Inc., General Mills, Inc., H&R Block, Inc., Helmerich & Payne, Inc., J.M. Smucker Co., Inc., KLA Corp., Inc., News Corp., Inc., NIKE, Inc., Parker-Hannifin Corp., Inc., Procter & Gamble Co., Qorvo, Inc., ResMed Inc., Symantec Corp., Inc., Sysco Corp., Inc., Tapestry, Inc., TE Connectivity Ltd., and Westrock Co.

6 Such companies are Apple Inc., Cisco Systems, Inc., Estee Lauder Companies Inc., Oracle Corp., and Walgreens Boots Alliance, Inc.

7 Such companies are Air Products & Chemicals, Inc., Deere & Co., NIKE, Inc., and Procter & Gamble Co.

8 This new requirement applies to audits of fiscal years ending on or after June 30, 2019 for large accelerated filers. It will only apply to the audits of accelerated filers, non-accelerated filers, and smaller reporting companies for fiscal years ending on or after December 15, 2020. Emerging growth companies are exempt.

9 Available at https://pcaobus.org/Standards/Documents/Implementation-of-Critical-Audit-Matters-The-Basics.pdf.

10 Although the PCAOB expects that this will be the case in most audits to which the CAM requirements apply, there also may be audits in which the auditor determines there are no CAMs. See https://pcaobus.org/Standards/Documents/Implementation-of-Critical-Audit-Matters-The-Basics.pdf.

11 Available at https://www.gibsondunn.com/pcaob-adopts-new-model-for-audit-reports.

12 Available at https://www.sec.gov/litigation/complaints/2019/comp-pr2019-194.pdf.

13 Discussed at https://www.sec.gov/news/press-release/2019-140.

14 Available at https://www.sec.gov/corpfin/risks-technology-intellectual-property-international-business-operations.

15 Available at https://blog.nacdonline.org/posts/esg-risks-trickle-into-financial-filings.

16 Discussion at https://news.bloomberglaw.com/bloomberg-law-analysis/analysis-tracking-secs-evolving-approach-to-esg-disclosures.

17 Available at https://www.worldprivacyforum.org/2019/10/wpf-advises-sec-regarding-data-risk-factors-and-disclosures.

18 Available at https://www.sec.gov/news/public-statement/libor-transition.

19 Available at https://www.wsj.com/articles/sec-questions-more-companies-about-sanctions-disclosures-11567018243.

20 Available at https://sec.report/Document/0001728949-19-000062.

21 Available at https://sec.report/Document/0001633917-19-000166.

22 Available at https://www.sec.gov/news/speech/hinman-applying-principles-based-approach-disclosure-031519.

23 Available at https://www.sec.gov/rules/interp/2018/33-10459.pdf.

24 Discussed at https://www.sec.gov/news/press-release/2019-194.

25 Available at https://www.ecfr.gov/cgi-bin/text-idx?SID=ad78279c826005efc3f7b98259940f3c&mc=true&node=se17.3.229_1102&rgn=div8.

26 Available at https://www.sec.gov/oca/staff-accounting-bulletin-119.

27 Available at https://www.gibsondunn.com/sec-continues-to-modernize-and-simplify-disclosure-requirements.

28 Discussed at https://www.sec.gov/info/smallbus/secg/fast-act-modernization-and-simplification-of-regulation-S‑K.

29 Available at https://www.securitiesregulationmonitor.com/Lists/Posts/Post.aspx?ID=334.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.