GoodRx Holdings, Inc. 10-Q

Item 4. Controls and Procedures. Limitations on effectiveness of controls and procedures In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply judgment in evaluating the benefits of possible controls and procedures relative to their costs. Evaluation of disclosure controls and procedures Our management, with the participation of our co-principal executive officers and principal financial officer, evaluated, as of the end of the period covered by this Quarterly Report on Form 10-Q, the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act). Based on that evaluation and as a result of the material weaknesses described below, our co-principal executive officers and principal financial officer concluded that, as of September 30, 2020, our disclosure controls and procedures were not effective at the reasonable assurance level. Material Weaknesses A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual and interim financial statements will not be detected or prevented on a timely basis. In connection with the preparation of our financial statements for 2019, we identified certain control deficiencies in the design and operation of our internal control over financial reporting that constituted material weaknesses. The material weaknesses are: • We did not design or maintain an effective control environment commensurate with our financial reporting requirements. We lacked a sufficient number of professionals with an appropriate level of accounting knowledge, training and experience to appropriately analyze, record and disclose accounting matters timely and accurately. Additionally, the limited personnel resulted in an inability to consistently establish appropriate authorities and responsibilities in pursuit of our financial reporting objectives, as demonstrated by, amongst other things, insufficient segregation of duties in our finance and accounting functions. • We did not effectively design and maintain controls in response to the risks of material misstatement. Specifically, changes to existing controls or the implementation of new controls have not been sufficient to respond to changes to the risks of material misstatement to financial reporting, due in part to acquisitions and other changes to our business. 34 These material weaknesses contributed to the following additional material we aknesses: • We did not design and maintain formal accounting policies, processes and controls to analyze, account for and disclose complex transactions. • We did not design and maintain formal accounting policies, procedures and controls to achieve complete, accurate and timely financial accounting, reporting and disclosures, including controls over the preparation and review of business performance reviews, account reconciliations and journal entries. Additionally, we did not design and maintain controls over the classification and presentation of accounts and disclosures in the financial statements. • We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain: (i) program change management controls to ensure that IT program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized, and implemented appropriately; (ii) user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to certain financial applications, programs and data to appropriate company personnel; (iii) computer operations controls to ensure that critical batch jobs are monitored and data backups are authorized and monitored, and (iv) testing and approval controls for program development to ensure that new software development is aligned with business and IT requirements. These material weaknesses resulted in adjustments identified by our independent registered public accounting firm and recorded by us primarily related to goodwill, capitalized software, leases, debt extinguishment, revenue recognition and sales allowances. These material weaknesses could result in a misstatement of our accounts or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected. Remediation Plans We are in the early stages of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404(a) of Sarbanes-Oxley Act and we are taking steps to remediate the material weaknesses. Management, with the participation of the Audit Committee and the Board of Directors, is engaged in remedial activities to address the material weaknesses described above. Those remediation measures are ongoing and include the following: • We have prepared a remediation plan for each of the material weaknesses and begun training process owners, evaluating process adoption and monitoring results. • We have engaged third party professionals to advise management in connection with the remediation of each of the material weaknesses. • We have recently hired, and plan to continue to hire, additional accounting and IT personnel during 2020 to bolster our technical reporting, transactional accounting and IT capabilities. We are implementing controls to formalize roles and review responsibilities to align with our team’s skills and experience and implement formal controls over segregation of duties. • We are implementing procedures to identify and evaluate changes in our business and the impact on our controls. • We are formally assessing complex accounting transactions and other technical accounting and financial reporting matters including controls over the preparation and review of accounting memoranda addressing these matters. During the quarter ended September 30, 2020, we implemented controls to identify complex accounting transactions and to require that the accounting implications of such transactions are formally assessed, documented and reviewed by a relevant senior member of our accounting team. In addition, we have engaged third party subject matter experts to advise us with respect to certain complex non-routine transactions in addition to management’s review of such transactions, where appropriate. • In the first quarter of 2020, we implemented a new enterprise resource planning, or ERP, system. We are in the process of designing and implementing controls over this ERP system to, among other things, automate certain controls, enforce segregation of duties and facilitate the review of journal entries. • We are implementing formal processes, policies, and procedures supporting our financial close process, including creating standard balance sheet reconciliation templates, establishing and reviewing thresholds for business performance reviews, and formalizing procedures over the review of financial statements. 35 • We are enhancing IT governance processes, including automating components of our change management and logical access processes, enhancing role-based access and logging capabilities, implementing automated con trols and implementing more robust IT policies and procedures over change management and computer operations. We believe we are making progress toward achieving the effectiveness of our internal control over financial reporting and disclosure controls and procedures. The actions that we are taking are subject to ongoing senior management review, as well as Audit Committee oversight. We will not be able to conclude whether the steps we are taking will fully remediate these material weaknesses in our internal control over financial reporting until we have completed our remediation efforts and subsequent evaluation of their effectiveness. We may also conclude that additional measures may be required to remediate the material weaknesses in our internal control over financial reporting, which may necessitate additional implementation and evaluation time. We will continue to assess the effectiveness of our internal control over financial reporting and take steps to remediate the known material weaknesses expeditiously. Changes in Internal Control over Financial Reporting We are taking actions to remediate the material weaknesses relating to our internal control over financial reporting. Except as otherwise described above, there were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the quarter ended September 30, 2020 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. 36 PART II—OTHER INFORMATION Item 1. Legal Proceedings. The information contained under the heading “Legal Proceedings” in Note 8 to our condensed consolidated financial statements included in this Quarterly Report on Form 10-Q is incorporated by reference into this Item.