Three requests, one set of facts
In the same month, the CFO of a privately held distributor receives three documents. The bank's annual credit review asks who reviews cash controls and how often. A national retailer's supplier onboarding form asks for the code of conduct, the anti-bribery policy and the address of an anonymous reporting channel. A prospective buyer's first diligence list asks for board minutes, the delegation of authority and any internal investigations in the last three years.
The CFO answers all three separately, in three formats, from the same facts. This is an illustrative example of a pattern any private company can recognize: in the United States, fewer disclosures are now required of private companies, and the people who rely on them ask anyway. A company that publishes a small, dated and evidenced set of facts can answer most of those requests once.
The mandates narrowed in 2026
Beneficial ownership reporting
FinCEN's final rule, issued on 11 August 2026 and effective 14 August 2026, exempts US companies from beneficial ownership information reporting under the Corporate Transparency Act. US persons do not have to provide their information either. Only entities formed under foreign law and registered to do business in a US state or tribal jurisdiction still report, and they do not report US-person owners. Banks' customer due diligence rules still apply, and state laws were not pre-empted. Beneficial ownership after the CTA rollback covers what remains.
The SEC climate rule
The SEC adopted climate disclosure rules for public companies in March 2024 and stayed them on 4 April 2024 while challenges were pending in the Eighth Circuit, so they never took effect. On 27 March 2025 the Commission voted to end its defense of the rules. On 29 May 2026 it proposed rescinding them in their entirety. As of November 2026 the rescission is still a proposal.
The rule applied only to public registrants. Its expected reach into private companies was always indirect, through customers collecting supplier data. That pressure now comes from California and the EU instead, as your customer wants your carbon data explains.
The questions stayed the same
A mandate gives every reader the same baseline. Without one, each reader writes its own questionnaire:
- Lenders want to know that the numbers behind a covenant are reliable and who checks them.
- Large customers ask about codes of conduct, anti-bribery, sanctions screening and, more often now, emissions.
- Funders and grantmakers ask how money is controlled and how concerns are raised.
- Acquirers and investors ask about governance, related parties and any history of investigations.
- Employees and candidates want to know whether raising a concern is safe.
The answers overlap heavily. Published once, they become a reference the company can point to, and a standard it holds itself to.
Five things worth publishing
Governance
Who sits on the board or advisory board, which committees exist and what they oversee, a summary of who may approve what, and how conflicts of interest and related-party transactions are handled.
Controls posture
A management statement, not an opinion. It names the framework the company uses to design controls, for example COSO's 2013 internal control framework, when key controls were last reviewed and by whom, what was found open, and when each open item is due to close. It should never read like an audit opinion, and it should say plainly that it is not one.
Speak-up statistics
How to raise a concern, who receives reports, and annual figures in ranges: reports received by category, median days to close, the share substantiated, and any retaliation complaints. Ranges protect confidentiality when numbers are small. The GRI Universal Standards, in effect for reporting from 1 January 2023, include general disclosures on mechanisms for seeking advice and raising concerns, which give a tested structure.
An independence statement
Who reviewed the published facts, what they reviewed and what they did not, and any other relationship they have with the company. If the reviewer is an employee, say so. If an outside firm helped, say exactly what it did.
Metrics informed by ISSB and GRI
A private company is not bound by either framework, but both offer a structure readers recognize. IFRS S1, effective for annual reporting periods beginning on or after 1 January 2024, organizes disclosure around governance, strategy, risk management, and metrics and targets. Borrowing that structure, and GRI's definitions for any metric you publish, makes figures comparable from year to year and harder to select favorably. Do not claim to report in accordance with a standard unless you meet all of its requirements.
What to publish, in three tiers
Tier one fits on a single page. Tier two needs a year of records behind it. Tier three is for companies that want readers to track commitments over time.
| Tier | What to publish | Evidence to keep | Refresh |
|---|---|---|---|
| 1. Start here | Board or owner contacts, committee list and what each oversees | Minutes, charters | When it changes |
| 1. Start here | Code of conduct and key financial policies, with approval dates | Approved versions | Annually |
| 1. Start here | Speak-up channel, who receives reports, anti-retaliation commitment | Channel test log | Twice a year |
| 1. Start here | Independence statement for everything published | Reviewer scope and relationships | Each publication |
| 2. After a year | Controls posture statement and the framework used | Review workpapers, open-items list | Annually |
| 2. After a year | Speak-up statistics in ranges | Case log with categories and close dates | Annually |
| 2. After a year | Approval authority summary and related-party policy | Approved matrix, related-party register | Annually |
| 3. Mature | Commitments with dated progress against each | Plan, owners, status evidence | Annually |
| 3. Mature | Metrics informed by ISSB or GRI, with methods | Calculation files and sources | Annually |
| 3. Mature | Change log covering everything above | Version history | Each change |
Decide where it lives
Two formats work, and they suit different facts. A standing page on your own website holds what changes irregularly: contacts, policies, the speak-up channel, and the date each item was last reviewed. An integrity center of this kind lets a supplier onboarding form be answered with a link. An annual report holds what belongs to a period: the controls posture statement, speak-up statistics, and commitments with progress against them. It gives a lender or a board a document they can file. Whichever you choose, keep the source documents behind each statement in one folder, so the next update starts from evidence and not from last year's wording.
Rules that keep it credible
- Publish only what you can evidence today. Each statement should trace to a document someone could inspect.
- Date everything and name an owner. An undated page is assumed stale.
- State scope and limits. Say which entities and which period are covered and what was not reviewed.
- Keep a metric when it gets worse. Dropping it says more than the number would.
- Never present a management statement as assurance. Describe any reviewer's role exactly.
- Keep a change log. Readers trust a page that shows what changed and when.
Where to start
Draft tier one this quarter from documents you already have, and set a date for the first annual refresh. Before publishing a controls posture statement, test it against your own answers with the controls health self-check. If you want the full report built, reviewed and published, our financial integrity report work covers governance, controls posture, speak-up statistics in the ranges you choose, and the independence statement.