The two documents regulators actually ask for, explained for leaders: what they contain, when you need them, and how to tell whether yours are real.