Preparing for the 2025 Public Company Reporting Season

In anticipation of the upcoming reporting season, this Update highlights some of the most significant rule changes, guidance, institutional investor areas of focus, and trends for public companies to consider while preparing annual report and proxy statement disclosures in 2025, including:

• Cybersecurity.
• Insider trading policies.
• Equity grant timing disclosures.
• Pay versus performance SEC staff comments.
• Proxy advisory voting guideline updates.
• Reminders and hot topics.

Cybersecurity

The U.S. Securities and Exchange Commission (SEC) adopted final rules on July 26, 2023, requiring public companies to provide current disclosure about material cybersecurity incidents on Form 8-K and to include disclosure relating to cybersecurity risk management, strategy, and governance in their annual reports on Form 10-K. For the specific requirements of the final rule, see our Update on this topic. 

As part of its regular review process for Form 10-Ks, the SEC staff has issued comments on the required cybersecurity disclosure. Generally, these comments have addressed technical compliance matters or disclosure consistency. The specific comments issued include the following:

• Management expertise. Item 106(c)(2)(i) of Regulation S-K calls for disclosure regarding the relevant expertise of members of management responsible for assessing and managing cybersecurity risks “in such detail as necessary to fully describe the nature of the expertise.” Several comments requested that companies provide additional details to comply with this requirement. 
• Third parties. Item 106(b)(1) of Regulation S-K requires disclosure regarding processes for assessing, identifying, and managing material cybersecurity risks, including engagement of third parties. The SEC staff has sought clarification or additional disclosure for this issue, particularly where companies have inconsistent disclosure regarding the engagement of third-party vendors in other portions of Form 10-K. 
• Clarifying management and oversight responsibilities. The SEC staff has requested explanation of the management team and board of directors' areas of responsibility regarding cybersecurity risk management and oversight, including details sufficient to understand each group’s responsibilities relative to respective processes in sufficient detail for a reasonable investor to understand, as required by Item 106(b)(1) of Regulation S-K.
• Risk management framework. Under Item 106(b)(1)(i) of Regulation S-K, companies must disclose how their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into the company’s overall risk management system or processes. Where companies provided disclosure on how cybersecurity risk management fits into their business strategy more broadly, the SEC staff has requested more specific disclosure addressing the disclosure requirement in the rule (i.e., how it fits into their overall risk management system).
• Missing item 106. The SEC staff commented to remind companies of the requirements where they did not include the new disclosures required by Item 106 of Regulation S-K.

Insider Trading Policies and Procedures

For companies with a calendar year end, compliance with the new exhibit filing and disclosure requirements relating to insider trading policies and procedures begins with the Form 10-K for fiscal year 2024 or related proxy statement. Under Item 408(b) of Regulation S-K, companies must disclose if they have adopted insider trading policies and procedures governing the purchase, sale, and/or other dispositions of the company’s securities by directors, officers and employees, or the company itself that are reasonably designed to promote compliance with insider trading laws, rules and regulations, and any applicable listing standards. Companies that have not adopted such policies and procedures must explain why they have not done so. The disclosure can also be forward incorporated by reference in the Form 10-K to a definitive proxy statement and must be provided in Inline XBRL. Companies must also file such policies and procedures as exhibits to their Form 10-Ks. A limited exception is available if all such policies and procedures are contained in the company's code of ethics and that code of ethics is filed as an exhibit to Form 10-K.

Companies generally are not required to revise their policies in preparation for filing their insider trading policies, although recent developments and SEC rule changes have prompted some to consider updates. Areas for consideration include: 

• How the policy addresses trading in other companies’ securities based on insider information learned through a person’s position at the company in light of the recent case SEC v. Panuwat regarding “shadow trading” (trading in the securities of an “economically-linked” company). This includes whether any such prohibition should apply to all other companies or a narrower set (such as business partners and competitors). For more information on shadow trading, see our blog post. 
• How the policy addresses the making of gifts while in possession of insider information. The SEC addressed gifts in its adopting release as an area where insider information could be misused and, therefore, should be addressed in the policy.
• Whether the policy has been updated to comply with the current requirements of Rule 10b5-1, as described in our blog post, to the extent Rule 10b5-1 plans are permitted under the policy. Companies should also consider whether to require preclearance for plan adoptions or modifications, as well as the treatment of terminations.
• Whether to address trades made by the company in their insider trading policy. The disclosure requirements under Item 408(b) of Regulation S-K call for disclosures of whether the company’s insider trading policy covers trading by the company itself. In light of the compliance function of an insider trading policy, many companies may determine that the broad rules and practices that apply to employees, officers, and directors may not make sense to apply to a company’s own transactions. Companies generally do not trade in their own securities without significant input from securities counsel, which likely obviates the need for application of a broad-based policy.

For non-calendar year companies, see our blog post regarding the Compliance & Disclosure Interpretations (C&DIs) published by the Division of Corporation Finance discussing the compliance dates.

Equity Grant Timing Disclosures

For companies with a calendar year end, the 2025 proxy statement will be the first to include annual disclosures pursuant to Item 402(x) of Regulation S-K regarding a company’s policies and procedures on the timing of options, stock appreciation rights (SARs), and similar awards and tabular disclosures of grants of such awards made close in time to the disclosure of material nonpublic information (MNPI). The new rules are effective for the first full fiscal year beginning on or after April 1, 2023 (or October 1, 2023, for smaller reporting companies). 

The new rules require a discussion of company policies and practices on the timing of awards of options, SARs, or similar awards in relation to their disclosure of MNPI, including:

• How the board (or compensation committee) determines when to grant such awards.
• Whether the board (or compensation committee) takes MNPI into account when determining the timing and terms of such awards and, if so, how.
• Whether the company has timed the disclosure of MNPI for the purpose of affecting the value of executive compensation.

In addition, detailed tabular disclosure is required for any options, SARs, or similar awards actually awarded to a named executive officer during the last completed fiscal year if such awards were granted during the period beginning four business days before and ending one business day after the company files a Form 10-Q or Form 10-K or files or furnishes a Form 8-K disclosing MNPI (other than a Form 8-K disclosing a material new option award grant under Item 5.02(e)). 

Information disclosed pursuant to Item 402(x) of Regulation S-K must be tagged in Inline XBRL.

Pay Versus Performance SEC Staff Comments

The SEC staff recently issued a significant number of comment letters addressing technical noncompliance in pay vs. performance disclosures required under Item 402(v) of Regulation S-K. These comments are in addition to the SEC’s comment letters issued in 2023 and the three sets of C&DIs the SEC staff issued in 2023. The 2024 comment letters address all aspects of the disclosure, including the pay vs. performance table and related notes, the relationships between certain company measures and compensation actually paid, and the company’s tabular list of its selected financial performance measures. Comments to the pay vs. performance table noted, among other things, incorrect reconciliations of summary compensation table values to amounts of compensation actually paid, failures to provide required disclosures about how non-generally accepted accounting principle (GAAP) company-selected measures are derived from the audited financial statements, and net income (loss) amounts that do not reflect the amounts reported in the audited GAAP financial statements. Given the SEC’s recent focus on these disclosures, companies are urged to revisit pay vs. performance staff interpretations, other related SEC guidance, and the rule in preparing their 2025 annual proxy statements to ensure their pay vs. performance disclosures fully comply with the SEC’s detailed requirements.

Proxy Advisory Firm Updates

As companies begin preparing for the 2025 proxy season, proxy advisory firm Glass Lewis has updated its voting guidelines for 2025, which may be found here. The Glass Lewis updates for 2025 focus on the following topics, among others, with additional analysis found in our blog post:

• Expectations and voting policies related to artificial intelligence (AI), including that companies should disclose the board’s role in overseeing issues related to AI.
• Expectations around board responsiveness to shareholder proposals that receive greater than 30% support, including additional disclosure regarding engagement for these proposals.
• Clarifications and revisions around the link between compensation and performance, emphasized as a holistic approach.
• Disclosure expectations around committee discretion for change-in-control arrangements. 

Similarly, Institutional Shareholder Services (ISS) has released its policy updates for 2025, which may be found here. The ISS updates for 2025 focus on the following topics:

• Transparency of the factors considered in the case-by-case evaluation of poison pills.
• Updates to the policy to recommend support for extension requests of up to one year from the original termination date of a special purpose acquisition company.
• Updates to the terminology in the policy relating to shareholder proposals to replace “General Environmental Proposals” with “Natural Capital-Related and/or Community Impact Assessment Proposals.”

ISS has also released its annual FAQs on executive compensation policies for 2025, which may be found here. Among other updates, two new FAQs address the following:

• Greater ISS focus on performance-vesting equity disclosure and design, particularly for companies with quantitative pay-for-performance misalignment.
• A clawback policy will be treated as “robust” for ISS purposes only if it also covers all time-vesting equity awards (consistent with an earlier off-cycle ISS FAQ).

ISS has also released its FAQs for equity compensation plans. No changes apply for 2025 under its Equity Plan Scorecard (EPSC) framework used in connection with its vote recommendations on equity plan proposals as to the factors considered, their weightings, or the passing scores required under the EPSC models.

Companies are advised to consider these voting guidelines and FAQs, along with the voting guidelines of any major institutional investors in the company, when considering governance practices, shareholder engagement, and proxy statement disclosures.

Reminders and Hot Topics

Form 10-K Clawback Checkboxes

With the new stock exchange listing rules regarding clawback policies in place, companies must accurately indicate on the cover page of Form 10-K (1) whether the financial statements of the company included in the filing reflect correction of an error to previously issued financial statements and (2) whether any such error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the company’s executive officers during the relevant recovery period. The first checkbox includes both “Big R” (i.e., correcting a material error in the previously issued financial statement) and “little r” restatements (i.e., correcting an error that was immaterial to the previously issued financial statement but would result in a material misstatement if left uncorrected in the current period or if recognized in the current period), along with any voluntary restatements. The second checkbox is limited to statutorily mandated recovery analysis that is required as part of “Big R” and “little r” restatements (but not by voluntary restatements), even if no recovery is ultimately made.

Focus on AI Disclosures

AI has been a topic of focus for the SEC, with guidance coming out from the Division of Corporate Finance in June 2024, along with more recent statements from SEC Chair Gary Gensler in September 2024. In light of this guidance, companies should consider their disclosures regarding AI, including: 

• Clearly defining what the company means by “AI.”
• Providing tailored (not boilerplate) disclosures about the material risks associated with the use of AI and the impact the technology is reasonably likely to have on the company’s business and financial results.
• Focusing on current and proposed uses of AI rather than generic buzz not relating to the company’s business.
• Having a reasonable basis for the company’s claims related to its use of AI.

Schedule 13G Filing Deadlines

As of September 30, 2024, new Schedule 13G filing deadline requirements went into effect. Under the new rules, all Schedule 13G filings must be amended within 45 days after the end of the calendar quarter in which there is a material change (rather than the old rule, which required amendment filings within 45 days after the calendar year for any material changes). Companies relying on Schedule 13G filings when completing the beneficial ownership table for the proxy statement may be surprised by the increased volume of Schedule 13G filings and should be sure to look for the most recent filing for each holder. For additional information about the beneficial ownership reporting changes, see our blog post.