We Found an Undisclosed Related-Party Transaction. Now What?

The discovery usually arrives sideways. A new controller reconciling vendor masters notices the CEO's brother-in-law behind an LLC billing $18,000 a month. An auditor's AS 2410 procedures surface a loan from a 6% holder that never made the D&O questionnaire. However it arrives, you now have a transaction that should have been disclosed, under Item 404 of Regulation S-K, ASC 850, or both, and wasn't. Here is the triage sequence, in the order that protects the company.

First question: was it actually reportable?

Do not concede the violation before running the elements. Item 404(a) requires all three: the company was a participant, the amount involved exceeded $120,000 (or your lower Item 404(d) threshold if you are a smaller reporting company, the lesser of $120,000 or 1% of average total assets for the last two fiscal years), and the related person had a direct or indirect material interest. Then check the instruction carve-outs: interests arising solely from another directorship, sub-10% ownership of the counterparty aggregated with family, competitive-bid pricing, ordinary-course banking services, and compensation reported under Item 402 or approved by the compensation committee.

Run the fact pattern through the Related-Party & Item 404 Disclosure Checker at app.unfoldingvalues.com with the actual dates, amounts, and relationship. Roughly a third of the "misses" I've triaged were not reportable once the elements were applied precisely, a conclusion worth exactly as much as the memo documenting it.

Then run ASC 850 separately. Different definition (10% principal owners, management, affiliates, equity-method investees), no dollar threshold, materiality-based. A transaction can flunk Item 404 and still belong in the footnote, or the reverse.

Was the transaction itself improper, or just undisclosed?

These are different problems with different clocks. Check three things immediately:

1. Legality. If the transaction involves an extension of credit to a director or executive officer, Exchange Act Section 13(k) (Sarbanes-Oxley Section 402) likely prohibited it outright. That is not fixable with disclosure; it needs securities counsel today.
2. Policy compliance. If your related-party transaction policy required audit-committee pre-approval and this bypassed it, Item 404(b)(2) requires you to identify unapproved reportable transactions in next year's disclosure. Ratification now, minuted properly, is the standard cure.
3. Accounting. Was the transaction recorded at all, and correctly? Undisclosed related-party transactions and misaccounted ones travel together, and the second is the one that forces restatement analysis.

Do we have to amend prior filings?

This is a materiality judgment, made with counsel and the audit committee, and it splits by document:

• Proxy/Part III disclosure (Item 404). If the omission is material to voting decisions, a director standing for election with an undisclosed financial interest in company transactions, amendment or supplemental disclosure before the next meeting deserves serious consideration. If the annual meeting has passed, the practical remedy is usually complete disclosure in the next proxy, with the two-year SRC lookback under Item 404(d) sweeping the prior-year transaction in anyway.
• Financial statements (ASC 850). A missing footnote is an error; whether it's a material error drives Item 4.02 non-reliance analysis versus correction in the next periodic filing as an immaterial revision. SAB 99 qualitative factors cut against you here: related-party omissions implicate management integrity, which the SAB expressly identifies as a factor that can render a quantitatively small misstatement material.
• Internal control. If the transaction evaded your controls, evaluate whether the identification-and-disclosure control failure is a significant deficiency or material weakness in ICFR. Document the conclusion either way; your auditor will.

Whatever you conclude, write it down contemporaneously. The SEC's 2023 order against Lyft: $10 million under Exchange Act Section 13(a) and Rule 13a-1 for omitting one director's interest in a shareholder's $424 million pre-IPO share sale from a single Form 10-K, is the controlling cautionary fact pattern: no fraud charge, no restatement, just an omitted Item 404 disclosure the company's process failed to catch.

How do we keep this from happening again?

The fix that satisfies an audit committee (and, later, an examiner) has four parts:

1. Rebuild the related-persons list from primary sources: Section 16 filings, 13D/G filings for 5% holders, questionnaire responses, and, the step most companies skip, entity-level research on family members' businesses.
2. Match, don't ask. Push the list against vendor, customer, payroll, and AP masters quarterly. Questionnaires catch what people remember; matching catches what they don't.
3. Lower the internal reporting trigger below the disclosure threshold. If your Item 404(d) threshold is $95,000, require internal reporting at $25,000 so aggregation and mid-year threshold drift can't strand a transaction just under the line.
4. Re-run the full population through the free Related-Party & Item 404 checker before every proxy and 10-K, and file the output with the disclosure workpapers. The artifact matters: when the question is "what was your process," a dated, documented screen is the difference between a comment-letter response and an enforcement narrative.

FAQ

Is failing to disclose a related-party transaction securities fraud?

Not automatically. The SEC can and does charge pure reporting violations: Exchange Act Section 13(a) and Rule 13a-1, as in the 2023 Lyft order, without alleging fraud. Scienter-based charges under Rule 10b-5 require more, but the reporting theory alone supports penalties.

Do we need to restate financial statements for a missing ASC 850 footnote?

Only if the omission is material to the financial statements taken as a whole. A material omission triggers Item 4.02 non-reliance and amendment; an immaterial one is corrected prospectively, but run SAB 99's qualitative factors honestly, because related-party omissions carry integrity implications.

Can the audit committee ratify a related-party transaction after the fact?

Yes, most policies expressly permit ratification, and Item 404(b) contemplates "review, approval, or ratification." Ratification cures the policy breach, not the disclosure obligation, and cannot cure a Section 13(k) prohibited loan.