What Is an Annual Report, and Why Only Half of It Is Audited

An annual report is two documents in one file. The first is the financial statements with their notes, and an independent auditor signs them. The second is the management report together with the CEO letter, and the auditor does not audit that: it only checks that the narrative agrees with the financial statements. Which means half the report carries a seal and the other half is a speech. The speech is still worth reading, but not to learn what happened: you read it to hear what the speaker is afraid of.

What an annual report contains#

The SEC's glossary describes the annual report to shareholders as "a document used by most public companies to disclose corporate information to their shareholders": an opening letter from the CEO, financial data, results of operations, segment information, new product plans. The regulated version, the Form 10-K, adds a full business description, Risk Factors, management's discussion and analysis (MD&A) and the audited statements. Outside the US the skeleton is the same with different labels. A Polish listed company files its annual report as a periodic report through the ESPI system. The regulation on periodic reports (Journal of Laws 2025, item 755) dictates the parts: a letter from the CEO, selected financial data, the financial statements, the management report, a corporate governance statement and the auditor's report.

Seven sections, one seal.

The three financial statements each have their own piece: the balance sheet tells you whether a bad year is survivable, and the income statement together with the segment note shows what the growth is made of and which business inside is paying for the others. The management report has no such piece, because there is no table in it that can be read on its own. You read it whole, and always against the previous year's.

Annual report vs 10-K#

The most common confusion is using the names interchangeably, and the SEC's own glossary opens its 10-K entry with a warning: "Although similarly named, the annual report on Form 10-K is distinct from the 'annual report to shareholders'". The 10-K is the regulated one: the business description, Risk Factors written under legal exposure, MD&A and audited statements. The shareholder annual report is the presentation layer on top, and some companies simply wrap the 10-K in a cover and send the same thing. If you read one of the two, read the one somebody is accountable for, not the one with the photographs.

A second confusion sits underneath: annual report versus financial statements. The financial statements are the tables and their notes: the balance sheet, the income statement, the cash flow statement, the statement of changes in equity and the notes. The annual report is the financial statements plus everything the company wants to say about them. The statements are the minutes; the annual report is the minutes with a speech attached.

In Europe there is a third wrinkle worth knowing. Companies whose shares trade on a regulated market have prepared consolidated statements under IFRS since 2005, because Regulation 1606/2002 says so, which means a Warsaw balance sheet reads by the same rules as a Frankfurt one. The narrative half has no such common rulebook. In Poland it is governed by article 49 of the Accounting Act, which requires the management report to cover the events that shaped the year, expected development, research achievements, the financial position, and risk factors and threats. The list is mandatory. The emphasis is not.

Are annual reports audited? Only half#

The auditor's report sits at the end, so it looks like a seal on the whole document. It covers less. The auditor gives an opinion on the financial statements: whether they present the company's position and result fairly under the applicable rules. On the management report the Polish Auditors Act, in article 83(3) (Journal of Laws 2017, item 1089), asks for two narrower statements. One: was it prepared in accordance with the regulations, and is it consistent with the information in the financial statements. Two: in light of what the auditor learned about the company during the audit, does it contain material misstatements. The US split is the same in substance: the auditor's opinion covers the financial statements and their notes, not the letter, not the strategy section, not the highlights.

Consistent is not the same as true. The auditor compares the numbers in the narrative with the numbers in the tables and looks for anything that contradicts what the audit itself turned up. Nobody checks whether "a challenging macroeconomic environment" is the reason the margin fell or a convenient phrase. Nobody checks whether "expected development" has a budget behind it. And nobody asks whether the risk on page forty got as much space as it gets at board meetings.

So the split runs like this. The numbers and the notes have someone from outside standing behind them who risks their own name. The narrative has management standing behind it, whose bonus depends on how the year is received, plus lawyers whose job is to make sure nothing in it can be used against the company. You take the facts from the numbers. From the narrative you take what management chose to stress and what it left out, and the second usually says more.

The management report is a stump speech#

Nobody reads a budget speech to learn the size of the deficit. You read it to see what the minister puts in the first sentence and what ends up in a subordinate clause on page twenty. The management report reads like any politician's speech, with one difference in the reader's favour: the law dictates the list of topics, so management cannot skip the risks or the financial position. It can only arrange them.

The first test is the subject of the sentence when a result is weak. A management team that writes that the segment margin fell because it cut prices to keep volume with its two largest customers is telling you something about itself. A team that spends four paragraphs on currencies, inflation and "a demanding environment" without once putting itself in the subject position is telling you something too. The second case is cheaper to produce.

The second test is proportion. Say the strategy section runs twelve pages and the risks run three. Someone decided where to put the weight, and that is information about management.

The third test is the CEO letter, read last. By then you know what happened, so you can see what got the opening paragraph and what got a comma.

One risk sentence that changed its wording#

The risk section is the only place where management is legally required to write about things it would rather not mention, and it does so under the eye of lawyers who know an omitted risk can be litigated. Which is why every sentence in it is weighed word by word. And which is why one word changing between year N and year N+1 means more than a new chapter on strategy.

Say the year-N report warns that the Company "may be exposed to pricing pressure from its largest customers". A year later the same sentence reads that "in the second half of the year the Company experienced pricing pressure from its largest customer, which affected segment profitability". Three changes: "may be" became "experienced", plural became singular, a generality became a half-year. None of them will make the CEO letter. All three say the risk stopped being a hypothesis and the company has one customer who sets its price.

Movement the other way is information too. A risk that sat at the top of the list for three years and in the fourth dropped to the bottom or vanished was either resolved or rewritten more gently, and the two cases look identical on paper. You settle it in the notes: if the provision for the disputed matter disappeared along with the risk, the matter ended; if the provision stayed and the risk disappeared, only the author of the paragraph changed.

The SEC gave evidence in 2020 of how far this section had grown. The amended Item 105 requires a summary of no more than two pages if the risk factor section exceeds 15 pages, and moves generic risks, those "that may generally apply to an investment in securities", to the end under a separate caption. Which means the regulator itself conceded that the section had become too long to read in full and told companies to separate the boilerplate from the specifics. You read the specifics: the risks that name a product, a customer, a country or a covenant. The boilerplate about pandemics and cyberattacks you read only when it moved on the list.

Read that way, the section usually yields the three risks the company had to disclose, and risk factors in an annual report are read sentence by sentence, with two consecutive reports open side by side and a pencil mark at every difference.

How to read an annual report, in order#

The document is arranged for the company's convenience: CEO letter first, risks deep in the middle, notes at the back. Where do you start, when the most interesting pages are furthest from the cover? At the back, because the reader's order is the reverse of the document's.

1. Risk Factors in the management report (Item 1A in a 10-K), ideally in two consecutive reports side by side.
2. Management's discussion of results (MD&A in a 10-K): the year explained in prose, with reasons attached or not.
3. The notes to the financial statements: customer concentration, provisions, how revenue is recognised, what exactly was adjusted in the "adjusted" result.
4. The financial statements: balance sheet, income statement, cash flow, with the notes already in your head.
5. The CEO letter last, as a tone sample.

This order has one cost: the first pass is slower, because notes read worse than letters. The second pass is faster, because you know which pages not to open. By the third pass you open only the risk section and whichever note was not there a year ago.

So read two consecutive annual reports rather than one: one tells you the state of the company, two tell you the direction, and the difference between them in the risk section is the cheapest information in the whole document.

Where to find an annual report#

For a US-listed company the Form 10-K is on the SEC's EDGAR full-text search, and the investor relations page usually hosts the designed version alongside it. For a company listed in Warsaw the annual report is a periodic report in ESPI, easiest to find in the ESPI/EBI report feed on the exchange's site filtered to annual reports, or on the company's own investor relations page. Nobody pays for any of these documents, because the company is required to publish them. The version with the cover and the photographs you treat like any other brochure: pleasant, optional.

When the narrative beats the numbers#

Does all of this not point the other way? If only the financial statements have an auditor behind them, read only the financial statements and leave the narrative to journalists. It is an honest position and it works for most of the year, because numbers have no adjectives and notes have no communications department.

Except that an audited balance sheet describes 31 December. A risk sentence describes the year that is just starting.

I think the narrative is the cheaper source of information about direction, on one condition: you read it comparatively, never on its own. A single CEO letter tells you nothing, because every CEO is pleased in it. The same letter next to last year's tells you which word disappeared. So you read the financial statements like minutes and the management report comparatively, sentence by sentence against the previous year's.

The method has a test ahead of it whose result I do not know yet. The December 2024 amendment to the Polish Accounting Act (Journal of Laws 2024, item 1863), which transposes the CSRD, adds a sustainability section to the management report with its own attestation by the auditor. The June 2025 regulation writes it into the layout of the periodic report from the reports for financial years beginning in 2024 or 2025. The first annual reports in the new layout, those for 2025, therefore arrived in spring 2026. The narrative has grown, and with it the number of sentences that will start changing in the second year for reasons that have nothing to do with the business. Whether comparative reading survives that second year I will check on the reports for 2026, in spring 2027.

Where this fits in Taufolio#

The Full report does with an annual report what I described above: it reads both halves and treats them differently. The sections on the business, the margins and the balance sheet stand on the financial statements and the notes. The risk section pulls out of the narrative the sentences that name a customer, a product or a covenant, with a quote and a link to the place in the filing, so you can check the context instead of taking anyone's word for it. At the top sits The gist of the report, every finding that changes the picture of the company, with no length limit. A Full report costs 100 credits, which is what a free account receives every month.

The Full report pro is built by Three models and a judge: three models write the analysis independently and a fourth compares the versions and keeps only what can be tied to a source. On the risk section that matters, because three models stop at different sentences and the judge has to say which of them the document actually supports. You then check management where it does not write its own script: in the Transcript, where it answers questions it did not draft. To see how both halves of an annual report look in a finished analysis of a real company, open the example reports.

The rule in one sentence: the auditor's seal tells you where the company stood on 31 December, and the risk sentence that changed its wording tells you where it is going.