Disclosure Controls and Insider Trading Checklist: A Practical Checklist

Document type: Checklist Practice area: Business and Corporate — Securities Jurisdiction: United States (federal) Last reviewed: 5 September 2026

Part 1 — Infrastructure

Disclosure committee:

Charter adopted, approved by the audit committee.
Membership includes: securities counsel or GC (chair), CFO, chief accounting officer or controller, internal audit, investor relations, CISO, and business unit representatives.
Meets before every periodic filing, and on call for 8-K events.
Minutes recorded, showing what was considered and decided.
Reports to the certifying officers before each filing and to the audit committee annually.
Every meeting includes a direct round: "what happened this quarter that is not in this document?"

Sub-certification:

Signer list current: business unit leaders, functional leaders (HR, IT, procurement, tax, treasury, legal, EHS), regional leaders, subsidiary controllers.
Questionnaire covers material contracts; litigation, claims, and regulatory contacts; investigations and subpoenas; accounting judgments and changes in estimates; related-party transactions; control deficiencies and any fraud; complaints about accounting or disclosure; customer and supplier developments; cybersecurity incidents; material employment matters; and an open catch-all.
Distributed early enough for signers to actually check.
"None" required rather than a blank.
Every affirmative answer followed up and documented.
Suspicious "none" answers questioned.
Completed forms retained as support for the Section 302 certification.

8-K trigger protocol:

One page, listing each triggering event and who to call.
Includes the catch-all: "anything that will be in the newspaper."
Distributed to everyone who might first learn of an event.
Included in manager onboarding and refreshed annually.
Included in the sub-certification package each quarter.
Escalation paths tested — can a plant manager reach the GC today?

Materiality assessment process:

A short memorandum for every close question, prepared contemporaneously.
Covers the facts; the quantitative analysis; the qualitative factors (masking a trend, covenant compliance, watched segments, management integrity, prior disclosure); the Basic Inc. v. Levinson, 485 U.S. 224 (1988) probability-magnitude balance for contingent events; and whether a specific disclosure obligation is triggered.
Participants and conclusion recorded.
No reliance on a percentage screen — TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976) and Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27 (2011) foreclose it.

Part 2 — The quarterly cycle

Sub-certifications distributed 10 days before quarter end.
Accounting close completed.
Sub-certifications returned; affirmative responses followed up.
Draft periodic report circulated.
MD&A drafted fresh from actual results and actual known trends — not edited from the prior quarter.
Every known material trend or uncertainty affirmatively confirmed as addressed.
Risk factors reviewed for changes.
Legal proceedings and subsequent events reviewed.
Disclosure committee meets while the draft can still change.
Open items resolved and documented.
Auditor review complete.
Earnings release, script, and Q&A prepared and legally reviewed.
Non-GAAP measures reconciled, with the GAAP measure given equal or greater prominence.
Audit committee approves the earnings release.
Earnings release furnished on Form 8-K.
Certifications executed with supporting documentation in hand.
Report filed.
Trading window dates published to covered persons.

Part 3 — Earnings and guidance

Script written, legally reviewed, and adhered to.
Safe harbor language read and included in the release, with specific, current cautionary factors — stale factors do not satisfy the PSLRA safe harbor.
Q&A prepared, including the questions the company will not answer.
The refusal rehearsed.
Guidance assumptions stated.
A written guidance update policy in place: forecast reviewed against guidance monthly; a defined variance triggers a legal assessment within a set period.
No executive affirms guidance outside a scheduled release without a current forecast review.
Quiet period resumes after the call.

Part 4 — Regulation FD

Written policy adopted, distributed, and trained annually with real transcript examples.
Designated spokespersons named; everyone else refers inquiries.
All investor and analyst meetings scheduled through IR with a legally reviewed materials pack.
Two company people on every call; notes taken.
Quiet period published to the market.
No confirmation, correction, or directional commentary on estimates.
Conference presentations webcast or materials furnished.
Social media channels identified in filings before being used for disclosure.
Confidentiality agreements or duties confirmed before any selective disclosure.

Remediation protocol, written and distributed:

Spokespersons instructed to call the GC immediately on any possible slip, from the hallway.
Reporting a possible slip is never held against the reporter; failing to report one is a policy violation.
Legal assesses the same day.
If required, public disclosure by the later of 24 hours or the next market open, under Regulation FD.
Assessment documented either way.

Part 5 — Insider trading policy

Scope:

Covers directors, officers, employees, and — for sensitive categories — family and household members and controlled entities.
Prohibits trading while aware of material non-public information, and tipping.
Prohibits trading in the securities of customers, suppliers, and counterparties when in possession of material non-public information about them.
Prohibits hedging, pledging, and margin accounts, or restricts them expressly.
Filed as an exhibit to the annual report, as required.

Windows and blackouts:

Regular quarterly blackout defined, with open and close dates published.
Event-specific blackout mechanism, with a written named list and a designated owner.
Persons on an event-specific blackout told they are restricted, without the reason being circulated more broadly.
Regulation BTR pension blackout notices when applicable.

Pre-clearance:

Required for directors, officers, and a designated group.
Check confirms: window open; not on an event-specific list; no Section 16(b) matchable transaction within six months before or after; and the person's written confirmation that they are not aware of material non-public information.
Pre-clearance expires in two to five business days.
Log maintained.

10b5-1 plans:

Adopted only during an open window.
Legal review before adoption.
Required certification executed and retained.
Cooling-off period at or above the rule's minimums (directors and officers: the later of 90 days or two business days after the periodic report for the quarter of adoption, capped at 120 days; others: 30 days).
No overlapping plans for open-market trades.
No more than one single-trade plan per twelve months.
Modifications require legal approval and restart the cooling-off period.
Company collects plan adoption, modification, and termination information for its quarterly disclosure obligation.
Good faith maintained throughout, not merely at adoption.

Section 16:

Named administrator.
EDGAR codes and powers of attorney current for every insider.
Form 3 on becoming subject; Form 4 within two business days; Form 5 annually.
Non-obvious events tracked: option exercises, gifts, transfers to trusts, tax withholding elections, deferred compensation elections, 401(k) company-stock transactions.
Six-month lookback and lookforward run before every approval.
Late filings tracked and reported; the target is zero.

Training:

Annual training and certification for all covered persons, with a record.
Separate, deeper training for directors, officers, and IR.

Part 6 — When something goes wrong

Hour 1:

Notify the GC; if the GC may be implicated, notify the audit committee chair.
Do not begin an investigation before deciding who directs it and under what privilege.
Delete nothing; instruct no one to delete anything.

Hours 1–8:

Litigation hold issued, broadly scoped; automatic deletion suspended.
Everyone who knows placed on an event-specific trading blackout.
Determine whether an imminent filing or release must be delayed.
Notify the D&O carrier if a notice obligation may be triggered.

Hours 8–48:

Decide who directs the investigation. If any member of senior management could be implicated, the audit committee directs it with independent counsel.
Scope initial fact-gathering: what happened, over what period, involving whom, with what accounting or disclosure consequence.
Assess whether an Item 4.02 non-reliance determination may be required; the four-business-day clock runs from the determination, which must be made without unreasonable delay.
Brief the auditors.
Prepare a holding statement.

Part 7 — Restatement

Non-reliance determination made by the board or audit committee.
Item 4.02 Form 8-K filed within four business days.
Accounting analysis: scope, periods, amounts, corrected presentation.
Internal control assessment; material weakness disclosure prepared; remediation plan.
Investigation conducted by appropriately independent counsel.
Amended filings prepared with revised certifications.
Class action preparation: preservation, and an expectation that investigation materials will be sought.
Sarbanes-Oxley Section 304 analysis for CEO and CFO incentive compensation, plus the exchange-mandated clawback policy.
Credit agreement and other covenant compliance reviewed.
D&O insurer notified.

Part 8 — Regulatory inquiries

Litigation hold immediately, scoped broadly.
Determine the posture: informal request, formal order, or routine examination.
Nothing produced before counsel reviews and negotiates scope.
Materiality of the inquiry assessed and documented under the Basic balance.
Consider whether the audit committee should direct the response.
Privilege preserved; any waiver decided deliberately.
Section 307 up-the-ladder reporting obligations understood by all counsel involved.

Part 9 — The annual cycle

10-K, with a full risk factor rewrite — start from the business, interview unit leaders, delete materialized and obsolete risks, quantify where possible, and confirm every forward-looking statement has a matching factor.
Internal control assessment under Section 404; auditor attestation where required.
Proxy statement, including compensation and pay-versus-performance disclosure.
Insider trading policy reviewed; re-certification by all covered persons; filed as an exhibit.
Regulation FD policy reviewed.
Disclosure committee charter reviewed.
Training delivered: insider trading, Regulation FD, 8-K triggers.
D&O questionnaires circulated and returned.
Audit committee report to the board on the effectiveness of the disclosure function.

Part 10 — Newly public company, first 90 days

Insider trading policy adopted, distributed, certified.
Trading windows established and calendar published.
Section 16 administration set up: EDGAR codes, powers of attorney, named administrator.
Regulation FD policy adopted; spokespersons designated.
Disclosure committee chartered; first meeting held.
Sub-certification list and questionnaire built.
8-K trigger protocol distributed; managers trained.
Clawback policy adopted per listing standards.
Whistleblower channel and audit committee complaint procedures established.
Executive team trained on Regulation FD and the earnings call.
Section 404 readiness work scoped; transition accommodations and their expiry understood.
Risk factors rebuilt from the business, not carried over from the prospectus.

Part 11 — Program health metrics

8-K filings made on the last permissible day (a pattern means information arrives late).
Late Section 16 filings (target: zero).
Sub-certification on-time return rate by function.
Escalations under the 8-K protocol that did not require a filing — this number should be well above zero.
Self-reported possible FD slips — same logic.
Comment letter items by category.
Materiality assessments documented in the period.
Training completion rate.
Whether business unit leaders can name who to call.