DEV Community

Cover image for The 6 Forensic Red Flags Hiding in SEC Filings Most Screeners Ignore
Lavelle Hatcher Jr
Lavelle Hatcher Jr

Posted on • Originally published at Medium

The 6 Forensic Red Flags Hiding in SEC Filings Most Screeners Ignore

A practical guide to reading the warning signs in a small company's own disclosures, before they show up in the price.

Note: This is educational content about how to read SEC filings, not investment advice. It does not recommend buying, selling, or holding any security. Always do your own research and consult a licensed professional before making financial decisions. Micro-cap stocks carry extreme risk, including the total loss of your capital.

A small company can file an 8-K disclosing that it has fallen out of compliance with its exchange's continued-listing rules, and the next morning most retail screeners will still show it sorted neatly by price and volume, with no indication anything is wrong. The warning was right there in the filing. The screener never opened it.

That gap is the whole reason I started reading filings by hand, and eventually the reason I wrote a tool to do the reading for me. But the tool matters less than the skill. If you understand what these red flags look like in a filing, you can spot them yourself with nothing but a browser and the SEC's free EDGAR database.

This is a walk through the six red flags I look for first in a small, thinly covered company, where they live in the filings, and why each one matters. None of this is exotic. It is all sitting in public documents that anyone can read for free. Most people just never do, because reading filings is tedious and screeners are easy.

Let's fix that.

Why screeners miss this

A stock screener reads numbers that someone else has already aggregated: price, market cap, P/E, maybe short interest. That feels like research, but it is reading a summary, not reading the company.

For a large, heavily covered company, that is often fine. Analysts pore over every disclosure, and problems surface quickly in the price. But for a small, thinly traded micro-cap, the things that actually matter, dilution, a going-concern warning, a delisting notice, a restatement, are disclosed in the company's SEC filings long before they reach the screener's columns. The signal is in the primary documents. The screener never opens them.

So if you want an edge in this corner of the market, the edge is simply this: read the filings the screener skips. Here is what to look for.

Red Flag 1: Delisting and continued-listing deficiency notices

This one lives in 8-K filings under Item 3.01, and it is one of the clearest warning signs in all of micro-cap investing, hiding in a structured, searchable field that almost nobody checks.

When a company falls out of compliance with its exchange's listing standards, for example its share price stays below the minimum bid requirement for too long, or its market value drops below a threshold, the exchange sends a deficiency notice. The company is generally required to disclose that notice in an 8-K under Item 3.01 ("Notice of Delisting or Failure to Satisfy a Continued Listing Rule or Standard"). An Item 3.01 does not guarantee the company will be delisted, companies often regain compliance, but it tells you the company is on the clock and that the exchange has formally put it on notice.

To find one yourself, pull the company's filing history on EDGAR, look through its recent 8-K filings, and check the item numbers on each cover. An Item 3.01 is the one you want. Read the body to see which rule was tripped (minimum bid price, market value, stockholders' equity, and so on) and what the company says it plans to do about it.

One honest caution: the notice tells you the company is in a compliance window, but it usually does not, by itself, tell you exactly how many days are left on the clock. That depends on the specific rule and the company's price history over time. So treat a 3.01 as "this company is in trouble with its exchange, dig deeper," never as a precise countdown.

Red Flag 2: Financial distress and solvency stress

A micro-cap that is burning cash and running low on solvency is a fundamentally different risk than one that is merely small, and the filings tell you which one you are looking at if you know where to look. The relevant documents are the financial statements in the 10-K and 10-Q, the auditor's report, and the notes.

The most direct signal is a going-concern qualification. Auditors are required to flag substantial doubt about a company's ability to keep operating, and when they do, it shows up in the auditor's report and the notes to the financial statements. The phrase to search for is literally "going concern." If you find it, stop and read that section in full, because it is one of the loudest warnings a set of financials can carry.

Beyond the explicit warning, you can assess distress quantitatively, and there are well-established published models for exactly that. The best known is the Altman Z-Score (with variants for non-manufacturing companies), which folds several balance-sheet and income-statement ratios into a single solvency reading that lands in a "safe," "grey," or "distress" zone. It has been studied and used for decades, and you can compute it by hand from the line items in the statements: working capital, retained earnings (a large accumulated deficit is telling on its own), operating income, and total liabilities against equity. Open the most recent 10-K and 10-Q, read the auditor's report for going-concern language, then run the ratios. It is not hard, just tedious, and that tedium compounds fast across a watchlist. (More on that later.)

Red Flag 3: Accounting quality and earnings-manipulation signals

This is the subtle one, and it is where forensic accounting earns its name. The question shifts from "is the company healthy" to something harder: "are the reported numbers even trustworthy, or are there statistical fingerprints suggesting the financials are being massaged?" You answer it by reading the financial statements across several periods, not from a single snapshot.

Two published models are the standard tools. The Beneish M-Score combines eight ratios (days-sales-in-receivables, gross-margin changes, asset-quality changes, total accruals, and others) into one number designed to flag a heightened probability of earnings manipulation. It was famously cited in connection with detecting the Enron irregularities before they became public. The Piotroski F-Score is the complement: a nine-point checklist of fundamental-health signals across profitability, leverage and liquidity, and operating efficiency, used to separate companies that are genuinely improving from ones quietly deteriorating.

Neither is a verdict, and it is important to hold them that way. A high Beneish M-Score does not prove manipulation; a low Piotroski F-Score does not prove a company is doomed. They are screening signals that tell you where to look harder. But they are rigorous, published, decades old, and computable from the numbers in the filings.

The practical obstacle is data. Both models depend on period-over-period changes, so you need at least two fiscal years of financials to compute them. EDGAR exposes structured financial data (the XBRL tags behind the statements) that makes this possible, but assembling two years of it by hand, for several companies, is exactly the kind of laborious bookkeeping nobody actually wants to do.

Red Flag 4: Dilution and aggressive capital raising

For a micro-cap, dilution is arguably the single most common way shareholders quietly lose money. The company issues new shares to raise cash, and every existing share is worth a little less. Done repeatedly, it grinds value down even if the business itself is fine. And it is all disclosed, if you read for it. The signals live in registration statements (S-1, S-3, F-1, F-3 and their variants), prospectus supplements (the 424B family), the share-count figures across filings, and 8-K disclosures of corporate actions.

The signals to watch:

  • Shelf registrations (typically Form S-3, or S-1 / F-3 for some companies) let a company register a large block of securities to sell over time. A live shelf is a loaded mechanism for future dilution.
  • At-the-market ("ATM") drip-selling, which you can often infer from repeated prospectus-supplement filings (the 424B family) over a short window. A steady stream of these can indicate the company is continuously feeding shares into the market.
  • Rising share counts over time. Pull the diluted-share figure from several consecutive filings and look at the trajectory. A rapidly climbing count is dilution in action; an accelerating one is worse.
  • Serial reverse splits. A company that repeatedly does reverse splits (consolidating shares to prop up the per-share price) is often masking ongoing dilution underneath. You can detect this from the share-count history, no price chart required.

To check it yourself in EDGAR, look for S-3 / S-1 / F-3 filings (shelf capacity), watch the cadence of 424B filings (ATM activity), and track the share count across the last several 10-Qs and 10-Ks. The trend tells the story.

Red Flag 5: Insider activity, the right way

Insider behavior is one of the most cited and most misunderstood signals. The key is to read it carefully, because the raw data is full of noise that looks like signal. It lives in Forms 3, 4, and 5 (insider transactions), Form 144 (proposed sales), and Schedules 13D and 13G (large ownership stakes).

The genuinely informative event is open-market buying: an insider using their own money to buy shares on the open market. That is a conviction signal, an insider voting with their wallet. In a Form 4, this is a transaction coded P (open-market purchase).

The trap is that a lot of what shows up as "insider acquisition" is not open-market buying. Stock grants (code A), option exercises (code M), and shares withheld to cover taxes (code F) are routine compensation events, not signals of conviction. If you count those as bullish "buying," you will badly misread the data. Genuine analysis separates real open-market purchases from routine compensation.

On the other side, Form 144 discloses an insider's intent to sell, and a cluster of these can indicate forward selling pressure ("overhang"). And Schedules 13D and 13G disclose when someone crosses a 5% ownership threshold, 13D signals an activist or strategic intent, 13G a passive holding.

To do this yourself, pull the company's Form 4 filings and read the transaction codes, do not just count "acquisitions." A genuine open-market P purchase by an officer or director means something; a tax-withholding F does not. This distinction is the whole game with insider data.

Red Flag 6: Material events in the 8-K record

The 8-K is the "something material just happened" filing, and its real power is that every event is filed under a specific, structured item code. Once you know the codes, a company's 8-K history stops being a pile of documents and becomes a readable timeline of its material events. These are the codes I weight most heavily for a small company:

  • Item 4.01: a change of auditor. Frequent or abrupt auditor changes can be a warning sign.
  • Item 4.02: non-reliance on previously issued financials, in plain terms, a restatement. This is one of the most serious items there is.
  • Item 5.02: departure or appointment of directors and officers. A wave of executive departures is worth understanding.
  • Items 2.03 / 2.04: the creation of a major financial obligation, or a triggering event that accelerates one. Both point to debt and liquidity stress.
  • Item 1.03: bankruptcy or receivership. (Self-explanatory.)
  • Item 3.02: unregistered sales of equity securities (another dilution-related disclosure).

The real skill is not spotting one 8-K, but reading the pattern over time, weighted by how serious each item is. A restatement (4.02) plus an auditor change (4.01) plus a string of officer departures (5.02) tells a very different story than a single routine filing. To do it yourself, pull the company's 8-K list on EDGAR, note the item number on each, and lay them out in order. The timeline usually speaks for itself.

Putting it together (and the tedious part)

None of these six red flags is hidden. They are all in public filings, filed under structured forms and item codes, free to read on EDGAR. The "edge" is not access, it is the willingness to actually open the documents and read them the way a screener never will.

Here is the honest catch, though, the one that sent me down this road in the first place: doing all six of these, by hand, for every company you are curious about, is genuinely laborious. Pulling the 8-K item codes, computing the Altman and Beneish ratios across two years of XBRL data, tracking share counts, reading every Form 4 transaction code, one company is an afternoon; a watchlist is a weekend you will not get back.

So I eventually built a free, open-source command-line tool, PennyTune, that does this reading automatically: it pulls a company's filings from SEC EDGAR and surfaces these same forensic signals, computed from the public filings, with the 8-K item codes named. It runs on public data with no API key, and it is deliberately built to surface evidence for your own due diligence, not buy or sell recommendations, which is exactly the spirit of this article.

If it is useful to you, it installs in one command:

pip install pennytune
Enter fullscreen mode Exit fullscreen mode

But I want to be clear about the order of importance: the technique matters more than the tool. Whether you run a CLI or read the filings by hand, the six red flags above are the same, and learning to recognize them is the durable skill. A tool just makes the reading faster. The judgment is, and should remain, yours.

The takeaway

For a small, thinly covered company, the risks that matter most are disclosed in SEC filings long before they reach a screener: delisting-deficiency notices (8-K Item 3.01), financial distress and going-concern warnings (the financials and auditor's report, plus models like Altman Z), accounting-quality and earnings-manipulation signals (Beneish M and Piotroski F across multiple periods), dilution and aggressive capital raising (shelf registrations, ATM activity, rising share counts, serial reverse splits), genuine insider buying versus routine compensation noise (Form 4 transaction codes), and the pattern of material events in the 8-K record (auditor changes, restatements, officer departures, and more). All of it is free to read on EDGAR. The only thing standing between you and it is the willingness to open the filings.

PennyTune is a free, open-source tool I built for this kind of analysis; it is on GitHub (pip install pennytune). This is educational content, not investment advice, and micro-caps carry extreme risk including total loss. Verify everything against the primary filings before acting on it.

Top comments (0)