What changed in this filing

/stocks — the workspaceLOADING

Item 9A. Controls and Procedures

2021-03-31 compared with 2020-03-31 · 53 added, 68 removed, 203 unchanged (37% of the section changed)

1 unchanged sentence

Evaluation of disclosure controls and procedures

Management, with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of the Company’s disclosure controls and procedures as of January 31, 2020, the end of the period covered by this Annual Report on Form 10-K.

Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of January 31, 2021, the end of the period covered by this Annual Report on Form 10-K.

The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms.

1 unchanged sentence

Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on such evaluation, and subject to the below exclusion, the Company’s Chief Executive Officer and Chief Financial Officer have concluded that, as of January 31, 2020, the Company’s disclosure controls and procedures were effective at the reasonable assurance level.

In accordance with interpretive guidance issued by SEC staff, companies are allowed to exclude acquired businesses from the assessment of internal control over financial reporting during the first year after completion of an acquisition and from the assessment of disclosure controls and procedures to the extent subsumed in such internal control over financial reporting (the “Internal Controls Guidance”).

In accordance with the Internal Controls Guidance, as the Company acquired WageWorks on August 30, 2019, management's evaluation and conclusion as to the effectiveness of the Company's disclosure controls and procedures as of January 31, 2020 excluded the portion of disclosure controls and procedures that are subsumed by internal control over financial reporting of WageWorks.

WageWorks’ assets represented approximately 11% of the Company’s consolidated total assets, excluding the effects of purchase accounting, and its revenues represented approximately 35% of the Company's consolidated total revenues, each as of and for the fiscal year ended January 31, 2020.

Based on such evaluation, our CEO and our CFO have concluded that as of January 31, 2021, the Company's disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting at its wholly owned subsidiary, WageWorks, described below.

Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses in its WageWorks subsidiary, management has concluded that the consolidated financial statements included elsewhere in this Annual Report on Form 10-K present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America.

Management's report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rule 13a-15(f) of the Exchange Act.

Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act.

The Company’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

1 unchanged sentence

Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of January 31, 2020.

In making this assessment of internal control over financial reporting, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control - Integrated Framework (2013).

Based on this assessment, management concluded the Company’s internal control over financial reporting was effective as of January 31, 2020.

In accordance with the Internal Controls Guidance, management has excluded WageWorks from its assessment of internal control over financial reporting as of January 31, 2020, because it was acquired by the Company in a purchase business combination during the fiscal year ended January 31, 2020.

WageWorks’ assets represented

approximately 11% of the Company’s consolidated total assets, excluding the effects of purchase accounting, and its revenues represented approximately 35% of the Company's consolidated total revenues, each as of and for the fiscal year ended January 31, 2020.

The Company’s independent registered public accounting firm, PricewaterhouseCoopers LLP has also audited the effectiveness of the Company’s internal control over financial reporting, excluding WageWorks, as of January 31, 2020.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of January 31, 2021 based on criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control - Integrated Framework (2013) (“COSO Framework”) .

Based on that assessment, management has concluded that, as of January 31, 2021, due to material weaknesses in internal control over financial reporting at its wholly owned subsidiary, WageWorks, the Company’s internal control over financial reporting was not effective.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

The Company’s independent registered public accounting firm, PricewaterhouseCoopers LLP has audited the effectiveness of the Company’s internal control over financial reporting as of January 31, 2021.

Its report appears in Part II, Item 8 of this Annual Report on Form 10-K.

Material Weaknesses in Internal Control over Financial Reporting

WageWorks disclosed the existence of material weaknesses in internal control over financial reporting in Item 9A of its Annual Report on Form 10-K for the year ended December 31, 2018.

While management did not include WageWorks in its assessment of internal control over financial reporting, management determined the material weaknesses included below were unremediated at WageWorks as of January 31, 2020.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement in annual or interim financial statements will not be prevented or detected on a timely basis.

Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities

There was an inadequate open flow, transparency, communication and dissemination of relevant and pertinent information from former WageWorks senior management concerning a complex transaction with the federal government that contributed to an ineffective control environment driven by the tone at the top.

WageWorks management’s failure to timely communicate all pertinent information resulted in an environment which led to errors in the WageWorks financial statements as of the fiscal year ended December 31, 2018.

It was noted that WageWorks did not maintain effective internal control over financial reporting related to the following areas:

control environment, risk assessment, control activities information and communication, and monitoring activities:

• WageWorks did not have processes and controls to ensure there were adequate mechanisms and oversight to ensure accountability for the performance of internal control over financial reporting responsibilities and to ensure corrective actions were appropriately prioritized and implemented in a timely manner.

• WageWorks did not effectively execute a strategy to attract, develop and retain a sufficient complement of qualified resources with an appropriate level of knowledge, experience, and training in certain areas important to financial reporting.

• There was not an adequate assessment of changes in risks by management that could significantly impact internal control over financial reporting or an adequate determination and prioritization of how those risks should be managed.

• WageWorks did not have adequate management oversight of accounting and financial reporting activities in implementing certain accounting practices to conform to its policies and GAAP.

• WageWorks did not have adequate management oversight around completeness and accuracy of data material to financial reporting.

• There was a lack of robust, established and documented accounting policies and insufficiently detailed procedures to put these policies into effective action.

• WageWorks was not focused on a commitment to competency as it relates to creating priorities, allocating adequate resources and establishing cross functional procedures around managing complex contracts and non-routine transactions as well as managing change and attracting, developing and retaining qualified resources.

These deficiencies in WageWorks' internal control over financial reporting contributed to the following identified material weaknesses:

Management identified certain deficiencies in WageWorks' internal control over financial reporting that aggregated to material weaknesses in the following components of the “COSO Framework”:

Risk Assessment – The WageWorks subsidiary did not sufficiently identify and analyze risks arising from changes in the business environment, including risks arising in connection with the integration of acquisitions and financial system implementations.

Information and Communication – The WageWorks subsidiary did not establish cross-functional procedures and policies relating to effective information and communication necessary to support the functioning of internal control over financial reporting.

Monitoring – The WageWorks subsidiary did not implement effective monitoring controls that were responsive to changes in the business or the timely remediation of identified control deficiencies.

The COSO Framework component material weaknesses described above contributed to deficiencies at the control activity level that aggregated to the material weaknesses described below:

Accounting Close and Financial Reporting

WageWorks had inadequate or ineffective senior accounting leadership and corresponding process level and monitoring controls in the area of accounting close and financial reporting specifically, but not exclusively, around the review of account reconciliations, account estimates and related cut-off, and monitoring of the accounting close cycle and some areas of related sub-processes such as equity.

WageWorks also did not have effective business processes and controls to conduct an effective review of manual data feeds into journal entries for platforms which were not integrated with the main enterprise resource planning system.

WageWorks did not have robust, established and documented accounting policies that were implemented effectively, which led to adjustments in areas such as, but not exclusive to, impairment of internally developed software (IDS) and unclaimed liability.

As a result of these adjustments, the accounts related to amortization of IDS, fixed assets, and operating expenses as they relate to interest and penalties were impacted.

WageWorks also did not have a robust process around managing change and corresponding assessment and implementation of accounting policies.

Furthermore, it also resulted in the delayed assessment and design of controls for the timely implementation of controls around Accounting Standard 606 (ASC 606) for Revenue Recognition, which was effective January 2018.

These gaps resulted in several adjustments in the WageWorks financial statements as of the fiscal year ended December 31, 2018.

The WageWorks subsidiary had inadequate process level and monitoring controls in the area of accounting close and financial reporting specifically, but not exclusively, around the review of account reconciliations, completeness and accuracy of data material to financial reporting, accounting estimates and related cut-off, the establishment, review, and implementation of accounting policies, and the review of the accuracy and completeness of certain manual and complex data feeds into journal entries and reconciliations of high-volume standard transactions.

Contract to Cash Process

WageWorks did not have effective controls around the contract-to-cash life cycle.

The root cause of these gaps were due to inadequate or ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements which require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, and availability of customer contracts.

These gaps resulted in several adjustments in revenue, accounts receivable, and accounts receivable reserves in the WageWorks financial statements as of the fiscal year ended December 31, 2018.

Risk Assessment and Management of Change

WageWorks did not maintain an effective risk assessment and monitoring process to manage the expansion of its business.

Hence, there were inadequate and ineffective business and financial reporting control activities associated with change and growth in the business.

Among other areas, the assessment of the control environment and the design of manual controls around financial system implementations was not performed adequately.

As a result, WageWorks did not properly estimate, reserve and record certain transactions that resulted in errors in the WageWorks financial statements as of the fiscal year ended December 31, 2018.

Review of New, Unusual or Significant Transactions and Contracts

WageWorks did not have adequate risk assessment controls to continuously formally assess the financial reporting risks associated with executing new, significant or unusual transactions, contracts or business initiatives.

As a result, WageWorks did not adequately identify and analyze changes in the business and hence implement effective process level controls and monitoring controls that were responsive to these changes and aligned with financial reporting objectives.

This failure to identify and analyze changes occurred in connection with the integration of acquisitions and the monitoring and recording of certain revenues associated with a complex government contract.

As a result, WageWorks did not properly account for certain transactions including revenue and customer obligation accounts, which resulted in errors in the WageWorks financial statements as of the fiscal year ended December 31, 2018.

Manual Reconciliations of High-Volume Standard Transactions

WageWorks did not have effective business processes and controls as well as resources with adequate training and support to conduct an effective review of manual reconciliations including the complex data feeds into the reconciliations of high-volume standard transactions.

This resulted in several errors mainly to

balance sheet classifications around accounts receivable, customer obligations and other related accounts as of December 31, 2018.

Information Technology General Controls (ITGC)

WageWorks did not have effective controls related to information technology general controls (ITGCs) in the areas of logical access and change-management over certain information technology (IT) systems that supported its financial reporting processes.

The WageWorks subsidiary did not have effective controls around the contract-to-cash life cycle of service fees, including ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements that require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, availability of customer contracts, and reviews of non-standard contracts.

Information Technology General Controls

The WageWorks subsidiary did not have effective controls related to information technology general controls (ITGCs) in the areas of logical access and change-management over certain information technology systems that supported its financial reporting processes.

WageWorks’ business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

WageWorks believed that these control deficiencies were a result of IT control processes having an inadequate risk-assessment process to identify and assess changes in business environment which would impact IT environments related to internal control over financial reporting.

Hence, the control design, implementation, and documentation were not enhanced to adapt to the changing business environment.

There was also insufficient training of IT personnel on how to design and implement ITGCs.

These material weaknesses and other deficiencies could result in a misstatement of the aforementioned account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

Remediation Efforts

The Company continues to assess the impact of the Acquisition on its internal control over financial reporting and has engaged an external internal control specialist to assist with creating a remediation plan.

These material weaknesses resulted in material misstatements of WageWorks' historical financial statements, which preceded the acquisition, and could result in a misstatement of our account balances or disclosures that would result in a material misstatement to the annual or interim condensed consolidated financial statements that would not be prevented or detected.

Remediation of Previously Reported Material Weakness

As previously reported, the WageWorks subsidiary had a material weakness related to the review of the accounting for new, unusual, or significant transactions.

Management incorporated certain WageWorks processes into the Company’s existing entity-level and process-level controls to address the identification, review and assessment of new, unusual, or significant transactions at WageWorks.

Management has concluded, following testing, that such controls are operating effectively, and that the material weakness was remediated as of January 31, 2021.

Ongoing Integration and Remediation Efforts

Management has assessed the impact of the acquisition of WageWorks on the Company's internal control over financial reporting and continues to assess changes driven by the integration of WageWorks with the existing operations at the consolidated Company.

As part of this assessment, management has continued to evaluate the Company's internal control environment to ensure that it has appropriate controls in place to mitigate the risks of a material misstatement to its consolidated financial statements associated with the WageWorks subsidiary and the Company as a whole.

In response to the COSO Framework component material weaknesses in the WageWorks subsidiary’s internal control over financial reporting, management has taken the following actions:

• performed a risk assessment and scoping of key systems and business processes, including a risk assessment at the financial statement assertion level to ensure that the level of precision of relevant controls is adequate to address the identified risks

• dedicated certain senior finance, accounting, and IT leadership team members to work on remediation efforts and appointed a third-party internal controls advisor to assist with such efforts

• developed a plan to implement a periodic assessment to monitor business changes impacting accounting processes and controls

• incorporated certain WageWorks processes into the Company’s existing entity-level controls

• established periodic reporting of the remediation plan progress to the Audit and Risk Committee;

• developed a plan to formalize documentation underlying processes and controls to promote knowledge and information transfer across functions and upon personnel changes

In addition to the steps above, specifically to address material weaknesses “A” through “C” above, the Company took the following measures:

• incorporated certain WageWorks processes into the Company’s process-level controls, including, but not limited to, those that address the monitoring of the accounting close cycle and the evaluation of accounting policies;

• developed and have begun to execute a plan to consolidate service platforms related to the contract-to-cash cycle which will reduce a significant number of manual business process controls;

• enhanced the design and have begun to monitor the operating effectiveness of controls related to logical access and change management for relevant WageWorks applications and systems.

As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plan described above.

As part of our integration efforts, we have developed a plan to migrate to one enterprise resource planning “ERP” system for the consolidated Company that will enhance our business and financial processes and standardize our information systems.

Changes in Internal Control Over Financial Reporting

As noted above, WageWorks has been excluded from management’s assessment of internal control over financial reporting as of January 31, 2020.

There were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2020 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other than as described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rules 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2021 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other information

22 unchanged sentences

Notes to consolidated financial statements

Supplementary quarterly financial data (unaudited)

(2) Financial statement schedules

10 unchanged sentences

4.1 Description of Securities of the Registrant

10-K 001-36568 4.1 March 31, 2020

4.2 Form of Common Stock Certificate.

93 unchanged sentences

S-1 333-173709 10.3 July 19, 2011

21.1+ List of Subsidiaries

23.1+ Consent of PricewaterhouseCoopers LLP, Independent Registered Public Accounting Firm.

24.1+ Power of Attorney (included in the signature page to this Annual Report).

10.37 Transition, Separation and Release Agreement between the Company and Ashley Dreier, dated February 13, 2020.

10-Q 001-36568 10.1 June 4, 2020

10.38 Amendment No.

1 to Employment Agreement between the Company and Jon Kessler, dated April 1, 2017

10-Q 001-36568 10.2 June 4, 2020

Incorporated by reference

1 unchanged sentence

Exhibit Filing Date

10.39 Transition and Separation Agreement between the Company and Darcy Mott, dated June 25, 2020.

10-Q 001-36568 10.1 September 9, 2020

10.40 Stock Purchase Agreement, by and among HealthEquity, Inc., the Sellers Listed on Schedule I and Evan McCordick, dated March 8, 2021.

8-K 001-36568 2.1 March 8, 2021

21.1+ List of Subsidiaries

23.1+ Consent of PricewaterhouseCoopers LLP, Independent Registered Public Accounting Firm.

24.1+ Power of Attorney (included in the signature page to this Annual Report).

31.1+ Certification of the Principal Executive Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

44 unchanged sentences

March 31, 2021 By:

/s/ Stuart B.

March 31, 2021 By:

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 9A. Controls and Procedures