Who this is for: individual investors and DIY analysts who use primary source documents—not headlines—to build or stress‑test a stock thesis.

What you’ll learn: an updated, repeatable 60‑minute workflow for reading a U.S. company’s annual 10‑K (and linked 8‑Ks/10‑Qs) in June 2026. The guide highlights new disclosure hooks—cyber incident reporting (Item 1.05), clearer climate metrics, and AI governance language—plus the exact ratios and footnote reads that change a valuation case.

Why it matters: earnings decks are marketing. A 10‑K remains the legal, audited record management signs under SEC rules. The numbers tell a different story when you triangulate financial statements, footnotes and MD&A. Since 2023–2024, investor focus and rule changes have made certain disclosures (cyber, climate metrics, AI governance) more standardized — and therefore more actionable for downside protection and valuation models.

Prerequisites/Context: What a 10‑K is (and what it isn’t)

A Form 10‑K is a public company’s annual filing with the SEC containing audited financial statements, MD&A, risk factors, and detailed footnotes. Most companies file within 60–90 days of fiscal year‑end depending on filer status.

Where to get it: SEC EDGAR is the authoritative source; Inline XBRL tagging is standard for most numeric line items. Use EDGAR’s full‑text search or the EDGAR API to pull filings. Paid services (Calcbench, S&P Capital IQ, TIKR) accelerate extraction but you can build a reliable, free workflow with EDGAR + an XBRL extractor.

Time box: The goal is to surface the handful of items that change valuation, growth durability, or balance‑sheet risk — not to memorize every paragraph.

Step 1 (5 minutes): Open the right documents and set your baseline

  1. Download current 10‑K (HTML/Inline XBRL) and prior year 10‑K. Export revenue, gross profit, operating income, net income, CFO, capex, total debt, cash, diluted shares via XBRL to avoid transcription errors.
  2. Pull the latest 10‑Q and any 8‑Ks filed after year‑end, including Item 1.05 cyber incident 8‑Ks. Material events (M&A, large impairments, cyber incidents) often show up in 8‑Ks first.
  3. Note three baseline items: fiscal year‑end, auditor and audit opinion (unqualified vs qualified), and filer status (large accelerated/accelerated/non‑accelerated).

Why this matters: fiscal timing affects seasonality; auditor changes or qualified opinions can flag disputes; filer status affects filing cadence and disclosure granularity.

Step 2 (10 minutes): Item 1 (Business) — treat it as a unit‑economics checklist

Skip corporate history. Focus on what drives gross profit and free cash flow.

  • Revenue model: quantify recurring vs one‑time revenue where possible. Many large SaaS and subscription businesses now disclose percentage recurring — record that number (e.g., “67% recurring revenue”).
  • Customer concentration: any customer >10% of revenue is material. Search the filing for “10%” and the customer note.
  • Key inputs and suppliers: single‑source vendors, commodity exposures, and pass‑through vs fixed contracts.
  • Technology/Security risks: in 2026, specifically look for “AI governance,” “model validation,” and cloud provider dependency (AWS/Google/Microsoft). Companies increasingly quantify third‑party service reliance.

Actionable mini‑check: in your browser, search the 10‑K for “recurr,” “renewal,” “churn,” “concentrat,” “contract liabilities,” “AI govern,” and “Item 1.05.” These pull up what drives near‑term cash and operational risk.

Step 3 (10 minutes): Item 1A (Risk Factors)—scan for what changed, not what merely exists

Risk factors are lawyer‑long. Your edge is spotting new or materially expanded risks.

  1. Compare versions: do a two‑document compare with last year’s filing to highlight added or expanded risks (search for “we have recently,” “as a result of,” “material weakness,” “Item 1.05,” “AI governance,” and “Scope 1/2/3”).
  2. Prioritize three categories:
    • Demand & execution: churn, pricing pressure, product‑market fit erosion.
    • Financing & liquidity: covenant exposure, upcoming maturities, variable‑rate debt sensitives.
    • Operational/regulatory: cyber incidents (Item 1.05 8‑Ks), AI model risk, and climate transition metrics/commitments.
  3. Update your watchlist: if “cybersecurity incident” or “AI governance” was newly added or upgraded, tag it for follow‑up — these risks have moved to central in many sectors since 2023.

Why this matters: new or expanded risks often precede surprises in margins, cash flow, or capital needs. Management typically flags material problems before the market fully prices them.

Step 4 (15 minutes): Financial statements—calculate the 6 ratios that move stock theses

Use Inline XBRL exports to avoid errors. Calculate these six metrics across 3 years when possible.

1) Revenue growth and gross margin

  1. YoY revenue growth % = (Current / Prior − 1) × 100
  2. Gross margin % = Gross profit / Revenue

Interpretation: If revenue +20% but gross margin down 300 basis points, ask whether pricing, mix, or input costs explain it. The numbers tell a different story when “record revenue” coincides with deteriorating unit economics.

2) Operating leverage

  • Operating margin % = Operating income / Revenue
  • Track SG&A % and R&D % of revenue over 2–3 years.

Interpretation: Scale should tend to improve margins unless the company is reinvesting. If operating margin falls while revenue growth slows, that’s a red flag.

3) Interest coverage and refinancing sensitivity

  • Interest coverage = EBIT / Interest expense
  • Net leverage = (Total debt − Cash) / EBITDA

Interpretation: Post‑2022 rate volatility left many issuers with higher coupon floors and near‑term maturities. If interest expense rises faster than EBIT and coverage slips under 3x, model refinancing cost scenarios and covenant risk.

4) Share‑count reality check

  • Dilution % = (Weighted‑average diluted shares / prior year − 1) × 100

Interpretation: Rising diluted share count from stock‑based compensation (SBC) or issuances can erode per‑share returns. Track SBC as a % of revenue (e.g., SBC = 12% of revenue vs peer median 5% is meaningful).

5) Cash conversion and FCF

  • CFO margin = Operating cash flow / Revenue
  • Free cash flow = CFO − Capex

Interpretation: Persistent gaps between net income and CFO indicate working capital swings or aggressive revenue recognition. If FCF margin is negative while EBITDA is positive, stress test cash needs over 12–24 months.

6) Working capital pressure points

  • DSO ≈ (Average accounts receivable / Revenue) × 365
  • Inventory days ≈ (Average inventory / COGS) × 365

Interpretation: Rising DSO or inventory days commonly presage demand weakness or collection issues. A 15–30 day increase in DSO year‑over‑year is a useful red‑flag threshold.

Step 5 (15 minutes): Footnotes—where the “gotchas” usually live

Footnotes reveal accounting choices, off‑balance‑sheet items and contingent exposures. Read them asking: what could hit cash or equity value if the business worsens 10–30%?

A) Revenue recognition and contract liabilities

  • Track contract liabilities/deferred revenue trends and new disclosures on customer billing terms (e.g., extended payment terms, milestone billing).
  • Watch variable consideration (rebates, performance credits) and bill‑and‑hold arrangements.

Why it matters: timing shifts can mask pull‑forwards that unwind later. If deferred revenue grows faster than annualized revenue recognition, quantify the potential for weaker future recognized revenue.

B) Stock‑based compensation (SBC)

  • Find total SBC, unrecognized equity compensation, and convert unvested awards into potential dilution. A quick rule: unrecognized SBC expense / current share price ≈ shares of future dilution (rough approximation).

Investor lens: SBC is real economic cost. If SBC is >10% of revenue, include it in operating cost when comparing peers.

C) Debt, covenants, hedging and maturities

  • Identify maturities in the next 12–36 months and fixed vs variable rate exposure.
  • Note hedging programs and fair‑value derivatives that can swing earnings.
  • Read covenant definitions—“consolidated EBITDA,” “minimum liquidity,” and cure periods—as these materially affect breach probabilities.

Why it matters: covenant breaches or expensive refinancing are fast paths to equity impairment.

D) Cybersecurity disclosures, insurance and indemnities

  • Check the incident and insurance disclosures (often in MD&A, risk factors and the contingencies footnote). Since the SEC’s Item 1.05 cyber disclosure rule, material incidents are more likely to appear in 8‑Ks and be described with timing, impact and remediation steps.
  • Look for cyber insurance limits, retentions and sublimits—these numbers cap indemnification and out‑of‑pocket exposure.

Why it matters: a single material incident can create multi‑year remediation costs, regulatory penalties, and customer churn.

E) AI governance, model risk and intellectual property

  • Scan footnotes and MD&A for “AI governance,” “model validation,” “training data,” and “third‑party models.” Note board‑level oversight or lack thereof.
  • Look for litigation or IP risk tied to training data licenses or model outputs in the contingencies note.

Why it matters: as companies rely on ML models for revenue or cost reduction, model failures or IP disputes can have outsized valuation impact. Companies that quantify governance — e.g., a model‑validation team or loss‑scenario backtesting — reduce uncertainty.

Step 6 (5 minutes): MD&A—validate the story against the numbers

MD&A is management’s narrative. Read it asking: do the drivers match your ratio work?

  • Does management explain margin moves quantitatively (e.g., “input costs increased $X million, compressing gross margin by Y bps”)? If not, flag for skepticism.
  • Are non‑GAAP adjustments reconciled and repeatable? If an “adjustment” reappears year after year, treat it as recurring.
  • Does liquidity discussion specify cash balances, revolver availability and maturities? If liquidity is dependent on the liquidity of a parent or short‑dated receivables, model stressed scenarios.

Common mistakes investors make when reading a 10‑K

  • Reading it like a novel: Use search, XBRL exports and year‑over‑year compares.
  • Ignoring cash flow: Net income is noisier than CFO over cycles — treat CFO and FCF as primary.
  • Missing dilution: Track diluted shares and SBC as a % of revenue and convert unrecognized SBC into potential shares.
  • Skipping debt footnotes: Maturity walls and variable‑rate exposure are common catalysts.
  • Trusting AI summaries blindly: LLMs speed sprints but can hallucinate numbers; always verify quoted figures against the filing.

Pro tips: How to get more signal in the same 60 minutes

  • Use Inline XBRL and EDGAR API: export the key line items and compute ratios in a spreadsheet in minutes. The SEC’s APIs and many vendor tools support bulk pulls now.
  • Targeted keyword sprint: search for “material weakness,” “going concern,” “covenant,” “impairment,” “restatement,” plus 2026 hooks: “Item 1.05,” “cybersecurity incident,” “AI governance,” “model validation,” “Scope 1,” “Scope 2,” and “transition risk.”
  • Three‑year trend standardization: compare revenue growth, gross margin, operating margin, FCF margin, net leverage and dilution % over three years. One year is noise; three reveals structure.
  • Separate accounting vs business changes: read “Summary of Significant Accounting Policies” and “Recently adopted accounting standards” for comparability issues.
  • One‑page tear sheet: revenue growth, gross margin, operating margin, FCF, net debt, diluted shares, plus three bullet risks with year‑over‑year tags. Revisit after each quarter.
  • Proxy (DEF 14A) signals: board turnover, CEO pay ratio and shareholder proposals can reveal governance and dilution appetite—important for long‑term thesis risk.

FAQ

How long should a focused 10‑K read take in 2026?

With Inline XBRL exports and a focused checklist, a first‑pass, investor‑grade read should take about 60–90 minutes. Expect an extra 1–3 hours for modeling, footnote deep dives, and preparing follow‑up questions for management.

What’s new I should look for in 2026 filings?

Prioritize disclosures tied to cyber (Item 1.05 8‑Ks), quantified climate metrics (Scope 1/2 in MD&A or risk factors), and explicit AI governance language (model validation, training data, board oversight). These areas are increasingly standardized and can change cash‑flow durability and legal exposure.

Can I rely on AI tools to summarize a 10‑K?

Use LLMs to speed the first pass, but verify every numeric claim and table against the filing. LLMs are good at surfacing sections to read, not at replacing line‑item validation. The numbers tell a different story when transcription or context errors slip into summaries.

Which red flags should prompt immediate follow‑up?

High‑signal items: going‑concern language, material weakness in internal control, a sudden jump in DSO or inventory days (15–30 day increases), large near‑term debt maturities without clear refinancing capacity, or a newly disclosed material cyber incident. Any of these should trigger further diligence.

How do I compare two companies’ 10‑Ks quickly?

Standardize the same six metrics (revenue growth, gross margin, operating margin, FCF margin, net leverage, dilution %) across three years. Then compare debt maturities, covenant language, revenue recognition policies and SBC treatment. Adjust for accounting differences before drawing conclusions.

Final note: the 10‑K is dense but high signal. Use search, Inline XBRL and a short checklist to find the handful of disclosures that change your valuation case. The numbers tell a different story when you triangulate statements, footnotes and cash flow — and in 2026 that includes specific attention to cyber incident disclosure, AI governance, and climate metrics that increasingly map to cash‑flow risk.