The annual report, and where to find the data
The answer
An annual report is 4 documents bound together: a promotional section, a set of statutory reports, the auditor's opinion, and the accounts with their notes.
Experienced readers open it at the auditor's report and read backwards from there. The chairman's letter is read last, if at all, and it is read as evidence about management rather than as information about the business.
Why this costs you money
Almost everybody reads an annual report in the order it is printed. That order was chosen by the company.
The first 40 pages are designed and paid for. Photographs, a chairman's letter, selected financial highlights, awards, and a business review written by the communications team. None of it is audited. Much of it is true. All of it is selected.
By the time a reader reaches page 90 they are tired, and page 90 is where the information starts. So the reader stops, and forms a view from the part of the document that was written to produce exactly that view.
This costs money in a specific way. The facts that would have changed your mind are almost always in the notes, and they are almost always disclosed. Not hidden. Disclosed, in a numbered note, in the same PDF you downloaded and did not finish.
Consider what sits in the back half of a typical report and never in the front half: which accounting policy the company chose where a choice existed; how much money moved between the company and entities its owners control; what the company has guaranteed for somebody else; what the auditor found difficult enough to write about; what the company owes that is not on the balance sheet; and which subsidiary made the profit.
Every one of those has ended somebody's investment. None of them appears in the highlights page. The reading order is not a matter of taste. It is the difference between having the information and not having it.
How it works
The 4 documents inside 1 report
1. The presentation section. Chairman's or managing director's letter, highlights, business overview, awards, sustainability material. Unaudited. Written to be read. Useful for exactly 1 purpose: comparing what management claims against what the numbers show, which is the exercise in article 2.
2. The statutory reports. In India this is the board's report, the management discussion and analysis, the corporate governance report, the directors' responsibility statement, the secretarial audit report and the remuneration disclosures. In the United States the equivalent material is spread across the 10-K's numbered items and a separate document called the proxy statement. These are required by law, checked to varying degrees, and contain several things nobody reads.
3. The auditor's report. Short, dense, and the most honest section in the document. It is written by somebody with a professional obligation and legal exposure, about a company that is paying them. That tension is exactly why it is worth reading closely.
4. The financial statements and the notes. The 4 statements take about 6 pages. The notes take 60 to 150. The notes are the report. Everything else is commentary on them.
The auditor's report, decoded
Read 4 things, in this order.
The type of opinion. There are 4 possibilities and the words matter.
- Unmodified, also called unqualified. The accounts give a true and fair view. This is normal.
- Qualified. The accounts are fine except for a specific item the auditor names. Read what the exception is. A qualification is rare and it is always worth understanding.
- Adverse. The accounts do not give a true and fair view. This is very serious and very rare.
- Disclaimer of opinion. The auditor could not gather enough evidence to form an opinion at all. Treat this as the strongest possible warning.
Emphasis of matter. A paragraph drawing attention to something already disclosed in the notes, without qualifying the opinion. It is not a qualification, and companies will say so. It is still the auditor pointing at something and asking you to look.
Material uncertainty related to going concern. A specific paragraph stating that events exist which cast significant doubt on the company's ability to continue operating. If this appears, nothing else in the report matters until you have understood it.
Key audit matters. This is the section this article exists for, and it is covered next.
Key audit matters: the most useful page nobody reads
Since roughly 2018 in India and 2019 in the United States, auditors of listed companies must describe, in plain language, the matters that required the most attention during the audit. India calls them key audit matters, under Standard on Auditing 701. The United States calls them critical audit matters, under PCAOB Auditing Standard 3101.
There are usually 2 to 5 of them. Each one names an area, explains why it was difficult, and describes what the auditor did about it.
This is remarkable, and almost nobody uses it. It is a professional, independent, legally exposed person telling you which numbers in the accounts are the most judgement-dependent, which means the most capable of being wrong.
Typical key audit matters, and what each is telling you:
- Revenue recognition — the timing of sales involves judgement. Look at when the company says a sale is made.
- Impairment of goodwill — an asset created by acquisitions is being tested against a forecast. The forecast is management's.
- Expected credit losses on receivables — how much of what customers owe will actually arrive is an estimate.
- Valuation of inventory — whether stock is worth what the books say.
- Litigation and tax provisions — how much has been set aside for disputes.
- Capitalisation of costs — whether spending was recorded as an asset or an expense.
Read them and you have management's own auditor telling you the 3 places to apply pressure.
CARO: an Indian report with no US equivalent
Indian auditors must also complete an annexure under the Companies (Auditor's Report) Order, 2020, usually called CARO. It is a fixed list of specific questions the auditor must answer in writing, roughly 21 clauses.
The questions include whether title deeds for immovable property are in the company's name, whether the company has defaulted on any loan repayment and to whom, whether loans have been given to related parties and on what terms, whether funds raised for one purpose were used for another, whether any fraud has been reported, whether the quarterly statements filed with banks agree with the books, and whether the company has transacted with companies struck off the register.
There is nothing like this in a US filing. It converts vague suspicion into a direct yes or no from a professional. Read it every year, on every Indian holding you have.
Where the documents live
India. The company's own investor relations page carries annual reports, usually 10 years of them. The BSE and NSE websites carry every filing: quarterly results, shareholding pattern, announcements, investor presentations and transcripts of results calls. The Ministry of Corporate Affairs holds filings for unlisted companies, which is how you find the accounts of a subsidiary that is only a single line in the group report.
United States. Everything is on the SEC's EDGAR database, free, with full-text search across all filings. The annual report is the Form 10-K, the quarterly is the Form 10-Q, and material events go on a Form 8-K within 4 business days. The DEF 14A proxy statement is a separate document and it carries executive pay, board members and related-party transactions.
The filing that arrives before the annual report
Indian listed companies publish results within 45 days of each quarter end. Those filings carry the statements but few notes. The annual report, with all the notes, arrives months later, often shortly before the annual general meeting.
That gap is where a lot of information sits unexamined. The market reacts to the results filing. The notes arrive when nobody is paying attention.
What it tells you, and what it does not
The report tells you what the company is required to say, and how it chose to say it. Both halves carry information. The required part is fact. The chosen part is evidence about management's character.
The audit tells you that a professional tested a sample and found nothing that changed their opinion. That is real and it is limited. An audit is not a search for fraud, and every large accounting fraud of the last 25 years was signed off by an established firm.
It does not tell you about the future. Nothing in the document is a forecast, except the assumptions inside impairment tests, and those are management's.
It does not include what was decided not to disclose. Materiality thresholds mean small items can be aggregated. A transaction below the threshold does not appear separately, and thresholds in a large company can be large.
It arrives late. An Indian annual report can be published 4 to 6 months after the year end. You are reading history, and the company has 2 more quarters of information you do not have.
The decision rule
Read every annual report in this order: auditor's report, then the notes on related parties, contingent liabilities and revenue recognition, then the statements, then the management discussion, then the chairman's letter.
If the auditor's opinion is anything other than unmodified, or there is an emphasis of matter, or a going concern paragraph, stop and resolve that before reading anything else — unless the matter is a routine industry-wide tax dispute disclosed identically by every competitor, in which case note it and continue.
Try this now
Five minutes. One holding. This is the exercise most investors have never done once.
- Download the latest annual report of 1 company you hold. In India use the investor relations page or the BSE or NSE site. In the United States open the Form 10-K on EDGAR.
- Search the PDF for the phrase "Key Audit Matters". In a US filing search for "Critical Audit Matters". It is inside the independent auditor's report, usually 2 or 3 pages long.
- Read each matter. There will be 2 to 5. For each one, write down 1 line: what area of the accounts it concerns, and why the auditor says it was difficult.
- For 1 of them, follow the reference. The auditor names the note number. Open that note and read it.
- Indian holdings only: go a few pages further to the annexure to the auditor's report and read the CARO clauses. Look specifically at the answers on loan defaults, loans to related parties, and use of funds.
What you should see. You should see a short, unemotional list of the parts of your company's accounts that are the most dependent on judgement. That list was written by somebody who spent months inside the company and has a licence to lose.
Most readers find something they did not know. Common examples: that most of the profit depends on an estimate of how much customers will eventually pay; that a large asset exists only because a forecast supports it; or that a tax dispute is larger than a year of profit.
You should also notice what is not there. If a company's largest risk in your own view is not mentioned by the auditor at all, either you are wrong about the risk, or the auditor is looking somewhere else. Both are worth knowing.
Three real cases
1. Manpasand Beverages, May 2019 (India) — the auditor left before the audit Manpasand Beverages was a listed fruit drinks company. In May 2019 its statutory auditor, Deloitte Haskins & Sells, resigned before completing the audit, citing a failure to receive information it had sought. The share price fell heavily over the following sessions. Company officials were subsequently arrested in connection with an alleged goods and services tax fraud. An auditor resigning part-way through an engagement is one of the highest-signal events available to a public investor. It is announced to the exchanges, it is free to read, and it takes 30 seconds to see.
2. Infosys, October 2019 to January 2020 (India) — an allegation that resolved the other way In October 2019 a group calling itself "Ethical Employees" sent whistleblower letters alleging that senior management had pressed for accounting treatments that would improve reported revenue and margins. The company disclosed the letters, the shares fell sharply on 22 October 2019, and the audit committee commissioned an independent investigation. In January 2020 the company announced that the investigation had found no evidence to support the allegations. This case is in the list deliberately. Not every red flag resolves badly. The correct response to a disclosure like this is to read the investigation's findings when they arrive, not to sell on the headline and not to ignore it.
3. Satyam Computer Services and its auditor, 7 January 2009 (India) — signed for years Chairman B. Ramalinga Raju admitted in a letter to his own board that the accounts had been manipulated over several years, with the largest single item being cash balances that did not exist. The accounts had been audited by the Indian member firms of a global network throughout. In January 2018 SEBI passed an order restraining Price Waterhouse network entities in India from auditing listed companies for 2 years, which was subsequently contested in appeal. The point for a reader is narrow and important: a clean audit opinion from a large firm is evidence, and it is not proof. Read the key audit matters and the CARO answers anyway.
The question that resolves it
A novice opens an annual report and asks: what does management say about the year?
An expert opens the same report and asks: what did the auditor find difficult, and what does the company have to disclose whether it wants to or not?
The first question is answered on page 6 in language chosen by the company. The second is answered on page 120 in language chosen by somebody else, and that is where the information asymmetry between you and the market is smallest.
What would make this wrong
If reading the auditor's report protected investors, then companies with clean opinions would not fail. They fail all the time.
Honest limits.
Key audit matters are often boilerplate. Many auditors describe the same areas for every client in an industry, in similar words. The signal is in changes: a matter added this year, or one removed.
The audit is a sampling exercise. It is designed to give reasonable, not absolute, assurance. It is not designed to detect a determined fraud by senior management working together with the finance function.
The auditor is paid by the company. Audit firms also sell other services in many markets, and audit fees are negotiated. Independence is a rule, not a law of nature.
Disclosure quality varies enormously. Two companies can comply fully with the same rules and produce reports of very different usefulness. A thin, vague note is itself information, but it is not proof of anything.
In India
The statutory package is larger than the US equivalent, and 3 parts of it are genuinely useful.
CARO, described above, has no American counterpart and directly answers questions an investor would otherwise have to infer.
The internal financial controls opinion. Indian auditors of most companies must give a separate opinion on the adequacy and operating effectiveness of internal financial controls over financial reporting, under Section 143(3)(i) of the Companies Act 2013. A qualification here is a serious signal.
The secretarial audit report, in Form MR-3, is prepared by a company secretary and covers compliance with company law and securities regulations. It is short and it names specific failures.
Related-party disclosure is heavier by design. Under SEBI's listing regulations, material related-party transactions require approval from shareholders other than the related parties themselves, and the audit committee must approve them. The thresholds have been tightened over time.
Auditor resignations must be explained. SEBI has required detailed disclosure of the reasons when an auditor resigns, precisely because the event carries so much information.
Auditor rotation is mandatory. Listed and certain other companies must rotate their audit firm after a maximum tenure, and the individual audit partner sooner, under Section 139(2) of the Companies Act 2013.
Both standalone and consolidated statements are published, each with its own auditor's report. Read both opinions. They are not always the same.
In the United States
The 10-K is a structured document with numbered items, which makes it fast to navigate once you know 5 of them: Item 1, Business; Item 1A, Risk Factors; Item 3, Legal Proceedings; Item 7, Management's Discussion and Analysis; and Item 8, Financial Statements and Supplementary Data. Item 1A and Item 7 both carry legal liability if misleading, which is why they are specific in a way most Indian narrative sections are not.
The proxy statement is a separate document and it is where the incentives are. The DEF 14A carries executive compensation in detail, including the targets a bonus depends on. If a bonus depends on adjusted earnings per share, you now know why the company reports adjusted earnings per share.
Form 8-K is the early warning system. A change of auditor, a disagreement with an auditor, a director resigning over a dispute, or a conclusion that previous accounts can no longer be relied upon must all be filed within 4 business days.
Internal control over financial reporting is audited separately for larger companies under Section 404 of the Sarbanes-Oxley Act of 2002, and a reported material weakness is a significant negative signal.
Full-text search across EDGAR is a genuine analytical tool. You can search every filing by every company for a phrase, which lets you find, for example, every company that named a particular counterparty.
Where they differ, and what that tells you
India gives you more direct answers. The United States gives you more searchable narrative.
CARO is the clearest example. An Indian auditor must state in writing whether the company defaulted on loan repayments and by how much. No American filing contains an equivalent direct answer, and a US investor must infer the same thing from the debt note and the cash flow statement. If you hold Indian shares and do not read CARO, you are ignoring the single most investor-friendly disclosure either market produces.
The United States wins on narrative and on searchability. Risk Factors, MD&A and the proxy statement force management to write down its own account of the business, its risks and its incentives, with liability attached. India's management discussion is required but is generally shorter, less specific, and more promotional, and there is no mandated risk-factor section of comparable depth in the annual report.
The reading strategy follows directly. In an Indian report, harvest the required answers: CARO, related parties, contingent liabilities, both auditor opinions, the pledge disclosure. In a US filing, harvest the narrative and then test it: read Item 1A across years, read the compensation targets in the proxy, then check whether the numbers behave the way the incentives would predict.
One practical warning about India. Because both standalone and consolidated statements exist, the auditor's report you find first may be the standalone one. The risks in an Indian group are usually in the subsidiaries. Make sure you read the key audit matters attached to the consolidated accounts.
Carry this
- Read the report backwards: auditor's report first, chairman's letter last.
- Key audit matters name the numbers most capable of being wrong. Read them every year.
- On Indian holdings, CARO gives direct written answers no US filing provides.