HEALTHEQUITY, INC. 10-Q

Item 4. Controls and Procedures Evaluation of Disclosure Controls and Procedures Management, with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of the Company’s disclosure controls and procedures as of October 31, 2020, the end of the period covered by this Quarterly Report on Form 10-Q. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide -34- Table of Contents only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based on such evaluation, the Company’s Chief Executive Officer and Chief Financial Officer have concluded that, as of October 31, 2020, due to material weaknesses in internal control over financial reporting at its wholly owned subsidiary, WageWorks, which the Company acquired on August 30, 2019, the Company’s disclosure controls and procedures were not effective. In accordance with interpretive guidance issued by SEC staff, the Company excluded WageWorks from its assessment of disclosure controls and procedures and internal control over financial reporting during the first year after completion of the acquisition. As of October 31, 2020, the WageWorks subsidiary is included in the above assessment regarding the effectiveness of the Company's disclosure controls and procedures. Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses in its WageWorks subsidiary, management has concluded that the consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America. Material Weaknesses in Internal Control over Financial Reporting Management identified certain deficiencies in WageWorks' internal control over financial reporting that aggregated to material weaknesses in the following components of the Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO Framework”): Risk Assessment - WageWorks did not sufficiently identify and analyze risks arising from changes in the business environment, including risks arising in connection with the integration of acquisitions and financial system implementations. Information and Communication – WageWorks did not establish cross-functional procedures and policies relating to effective information and communication necessary to support the functioning of internal control over financial reporting. Monitoring – WageWorks did not implement effective monitoring controls that were responsive to changes in the business or the timely remediation of identified control deficiencies. The COSO Framework component material weaknesses described above contributed to deficiencies at the control activity level that aggregated to the material weaknesses described below: A. Accounting Close and Financial Reporting The WageWorks subsidiary had inadequate process level and monitoring controls in the area of accounting close and financial reporting specifically, but not exclusively, around the review of account reconciliations, completeness and accuracy of data material to financial reporting, accounting estimates and related cut-off, the establishment, review, and implementation of accounting policies, and the review of the accuracy and completeness of certain manual and complex data feeds into journal entries and reconciliations of high-volume standard transactions. B. Contract to Cash Process The WageWorks subsidiary did not have effective controls around the contract-to-cash life cycle of service fees, including ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements that require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, availability of customer contracts, and reviews of non-standard contracts. C. Review of New, Unusual or Significant Transactions The WageWorks subsidiary did not have adequate controls over the review of the accounting for new, significant or unusual transactions. D. Information Technology General Controls The WageWorks subsidiary did not have effective controls related to information technology general controls (ITGCs) in the areas of logical access and change-management over certain information technology systems that supported its financial reporting processes. WageWorks’ business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. -35- Table of Contents These material weaknesses resulted in material misstatements of WageWorks' historical financial statements, which preceded the acquisition, and could result in a misstatement of our account balances or disclosures that would result in a material misstatement to the annual or interim condensed consolidated financial statements that would not be prevented or detected. Integration and Remediation Efforts Management has assessed the impact of the acquisition of WageWorks on its internal control over financial reporting and continues to assess changes driven by the integration of WageWorks with the existing operations at the consolidated Company. As part of this assessment, management has continued to evaluate its internal control environment to ensure that it has appropriate controls in place to mitigate the risks of a material misstatement to its consolidated financial statements associated with the WageWorks subsidiary and the Company as a whole. In response to the material weaknesses in WageWorks’ internal control over financial reporting, management has developed a plan to address the deficiencies associated with the disclosed material weaknesses, continues to utilize a third-party internal controls specialist, and has dedicated certain senior finance and accounting leadership team members to work on remediation efforts. As previously disclosed, the WageWorks subsidiary had a material weakness related to an ineffective control environment, which was driven by the tone at the top of WageWorks. Due to the tone at the top, there was inadequate or ineffective senior accounting leadership, an insufficient complement of qualified resources with an appropriate level of knowledge, experience and training important to the Company’s financial reporting requirements, and inadequate mechanisms and oversight to ensure accountability for the performance of internal control over financial reporting responsibilities. This material weakness has now been remediated. The following steps were executed by the Company to remediate the ineffective control environment driven by the tone at the top: • replacement of WageWorks Audit Committee, Board of Directors, senior managers and executives, and organizational realignment; • incorporation of WageWorks into the Company's training programs, led by the CEO and reinforced by executives throughout the combined Company, on the Company's Code of Business Conduct and Ethics, which included raising awareness and understanding of the importance of financial reporting integrity; • incorporation of WageWorks control environment into the oversight of the Company’s Internal Audit function and management’s certification of internal controls, • realignment of the WageWorks annual employee performance process to include consideration of employees’ demonstration of the Company’s values, including accountability for performance of internal controls; and • incorporation of WageWorks into the Company’s process to attract, develop, and retain a sufficient complement of qualified resources with appropriate and relevant competencies. Additionally, in partial response to the other material weaknesses discussed above, management has incorporated certain WageWorks processes into the Company’s existing entity-level and process-level controls, including, but not limited to, those that address the identification, review and assessment of new, unusual or significant transactions, those that address the monitoring of the accounting close cycle and the evaluation of accounting policies, and those that address certain ITGCs. Management is in the process of testing the operating effectiveness of these controls. Changes in Internal Control Over Financial Reporting Other than as described in the Integration and Remediation Efforts section above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended October 31, 2020 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting. -36- Part II—Other Information