HEALTHEQUITY, INC. 10-K

Item 9A. Controls and Procedures Evaluation of disclosure controls and procedures Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of January 31, 2021, the end of the period covered by this Annual Report on Form 10-K. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based on such evaluation, our CEO and our CFO have concluded that as of January 31, 2021, the Company's disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting at its wholly owned subsidiary, WageWorks, described below. Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses in its WageWorks subsidiary, management has concluded that the consolidated financial statements included elsewhere in this Annual Report on Form 10-K present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America. Management's report on internal control over financial reporting Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. The Company’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Management assessed the effectiveness of the Company’s internal control over financial reporting as of January 31, 2021 based on criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control - Integrated Framework (2013) (“COSO Framework”) . Based on that assessment, management has concluded that, as of January 31, 2021, due to material weaknesses in internal control over financial reporting at its wholly owned subsidiary, WageWorks, the Company’s internal control over financial reporting was not effective. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. The Company’s independent registered public accounting firm, PricewaterhouseCoopers LLP has audited the effectiveness of the Company’s internal control over financial reporting as of January 31, 2021. Its report appears in Part II, Item 8 of this Annual Report on Form 10-K. -79- Table of Contents Management identified certain deficiencies in WageWorks' internal control over financial reporting that aggregated to material weaknesses in the following components of the “COSO Framework”: Risk Assessment – The WageWorks subsidiary did not sufficiently identify and analyze risks arising from changes in the business environment, including risks arising in connection with the integration of acquisitions and financial system implementations. Information and Communication – The WageWorks subsidiary did not establish cross-functional procedures and policies relating to effective information and communication necessary to support the functioning of internal control over financial reporting. Monitoring – The WageWorks subsidiary did not implement effective monitoring controls that were responsive to changes in the business or the timely remediation of identified control deficiencies. The COSO Framework component material weaknesses described above contributed to deficiencies at the control activity level that aggregated to the material weaknesses described below: A. Accounting Close and Financial Reporting The WageWorks subsidiary had inadequate process level and monitoring controls in the area of accounting close and financial reporting specifically, but not exclusively, around the review of account reconciliations, completeness and accuracy of data material to financial reporting, accounting estimates and related cut-off, the establishment, review, and implementation of accounting policies, and the review of the accuracy and completeness of certain manual and complex data feeds into journal entries and reconciliations of high-volume standard transactions. B. Contract to Cash Process The WageWorks subsidiary did not have effective controls around the contract-to-cash life cycle of service fees, including ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements that require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, availability of customer contracts, and reviews of non-standard contracts. C. Information Technology General Controls The WageWorks subsidiary did not have effective controls related to information technology general controls (ITGCs) in the areas of logical access and change-management over certain information technology systems that supported its financial reporting processes. WageWorks’ business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. These material weaknesses resulted in material misstatements of WageWorks' historical financial statements, which preceded the acquisition, and could result in a misstatement of our account balances or disclosures that would result in a material misstatement to the annual or interim condensed consolidated financial statements that would not be prevented or detected. Remediation of Previously Reported Material Weakness As previously reported, the WageWorks subsidiary had a material weakness related to the review of the accounting for new, unusual, or significant transactions. Management incorporated certain WageWorks processes into the Company’s existing entity-level and process-level controls to address the identification, review and assessment of new, unusual, or significant transactions at WageWorks. Management has concluded, following testing, that such controls are operating effectively, and that the material weakness was remediated as of January 31, 2021. Ongoing Integration and Remediation Efforts Management has assessed the impact of the acquisition of WageWorks on the Company's internal control over financial reporting and continues to assess changes driven by the integration of WageWorks with the existing operations at the consolidated Company. As part of this assessment, management has continued to evaluate the Company's internal control environment to ensure that it has appropriate controls in place to mitigate the risks of a material misstatement to its consolidated financial statements associated with the WageWorks subsidiary and the Company as a whole. -80- Table of Contents In response to the COSO Framework component material weaknesses in the WageWorks subsidiary’s internal control over financial reporting, management has taken the following actions: • performed a risk assessment and scoping of key systems and business processes, including a risk assessment at the financial statement assertion level to ensure that the level of precision of relevant controls is adequate to address the identified risks • dedicated certain senior finance, accounting, and IT leadership team members to work on remediation efforts and appointed a third-party internal controls advisor to assist with such efforts • developed a plan to implement a periodic assessment to monitor business changes impacting accounting processes and controls • incorporated certain WageWorks processes into the Company’s existing entity-level controls • established periodic reporting of the remediation plan progress to the Audit and Risk Committee; and • developed a plan to formalize documentation underlying processes and controls to promote knowledge and information transfer across functions and upon personnel changes In addition to the steps above, specifically to address material weaknesses “A” through “C” above, the Company took the following measures: • incorporated certain WageWorks processes into the Company’s process-level controls, including, but not limited to, those that address the monitoring of the accounting close cycle and the evaluation of accounting policies; • developed and have begun to execute a plan to consolidate service platforms related to the contract-to-cash cycle which will reduce a significant number of manual business process controls; and • enhanced the design and have begun to monitor the operating effectiveness of controls related to logical access and change management for relevant WageWorks applications and systems. As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plan described above. As part of our integration efforts, we have developed a plan to migrate to one enterprise resource planning “ERP” system for the consolidated Company that will enhance our business and financial processes and standardize our information systems. Changes in Internal Control Over Financial Reporting Other than as described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rules 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2021 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting. Item 9B. Other information None. -81- Table of Contents PART III. Item 10. Directors, executive officers and corporate governance The information required by this Item 10 of Form 10-K is found in our 2021 Proxy Statement to be filed with the SEC in connection with the solicitation of proxies for the Company's 2021 Annual Meeting of Stockholders is incorporated by reference to our 2021 Proxy Statement will be filed with the SEC within 120 days after the end of the fiscal year to which this report relates. Code of business conduct and ethics Our board of directors has adopted a Code of Business Conduct and Ethics that applies to all of our team members, officers and directors, including our Chief Executive Officer, Chief Financial Officer, and other executive and senior financial officers. The full text of our Code of Business Conduct and Ethics is posted on our website at www.healthequity.com in the Corporate Governance section of our Investor Relations webpage. We intend to post any amendments to our Code of Business Conduct and Ethics, and any waivers of our Code of Business Conduct and Ethics for directors and executive officers, on the same website. Item 11. Executive compensation The information required by this Item 11 of Form 10-K is incorporated by reference in our 2021 Proxy Statement. Item 12. Security ownership of certain beneficial owners and management and related stockholder matters The information required by this Item 12 of Form 10-K is incorporated by reference in our 2021 Proxy Statement. Item 13. Certain relationships and related transactions, and director independence The information required by this Item 13 of Form 10-K is incorporated by reference in our 2021 Proxy Statement. Item 14. Principal accounting fees and services The information required by this Item 14 of Form 10-K is incorporated by reference in our 2021 Proxy Statement. -82- Table of Contents Part IV. Item 15. Exhibits, financial statement schedules (a) Documents filed as part of this report (1) All financial statements Index to consolidated financial statements Page Consolidated Balance Sheets as of January 31, 2021 and 2020 54 Consolidated Statements of Operations and Comprehensive Income for the years ended January 31, 2021, 2020 and 2019 55 Consolidated Statements of Stockholders' Equity for the years ended January 31, 2021, 2020 and 2019 56 Consolidated Statements of Cash Flows for the years ended January 31, 2021, 2020 and 2019 57 Notes to consolidated financial statements 59 (2) Financial statement schedules All financial statement schedules have been omitted, since the required information is not applicable or is not present in amounts sufficient to require submission of the schedule, or because the information required is included in the consolidated financial statements and notes thereto included in this Form 10-K. -83- Table of Contents (3) Exhibits required by Item 601 of Regulation S-K Exhibit Index Incorporated by reference Exhibit no. Description Form File No. Exhibit Filing Date 3.1 Amended and Restated Certificate of Incorporation of the Registrant 8-K 001-36568 3.2 July 6, 2018 3.2 Amended and Restated Bylaws of the Registrant 8-K 001-36568 3.4 July 6, 2018 4.1 Description of Securities of the Registrant 10-K 001-36568 4.1 March 31, 2020 4.2 Form of Common Stock Certificate. S-1/A 333-196645 4.1 July 16, 2014 4.3 Amended and Restated Registration Rights Agreement, dated August 11, 2011, by and among the Registrant and certain of its stockholders. S-1 333-196645 4.2 June 10, 2014 10.1 Form of Indemnification Agreement by and between the Registrant and its directors and officers. S-1/A 333-196645 10.1 July 16, 2014 10.2† HealthEquity, Inc. 2014 Equity Incentive Plan and Form of Award Agreement. S-1 333-196645 10.2 June 10, 2014 10.3† HealthEquity, Inc. 2014 Amended and Restated Equity Incentive Plan and Form of Award Agreement. S-1/A 333-196645 10.3 July 16, 2014 10.4† HealthEquity, Inc. 2009 Stock Plan and Form of Stock Option Agreement. S-1 333-196645 10.4 June 10, 2014 10.5† HealthEquity, Inc. 2006 Stock Plan and Form of Stock Option Agreement. S-1 333-196645 10.5 June 10, 2014 10.6† HealthEquity, Inc. 2005 Stock Plan and Form of Stock Option Agreement. S-1 333-196645 10.6 June 10, 2014 10.7† HealthEquity, Inc. 2003 Stock Plan and Form of Stock Option Agreement. S-1 333-196645 10.8 June 10, 2014 10.8† HealthEquity, Inc. Section 409A Specified Employee Policy. S-1 333-196645 10.23 June 10, 2014 10.9† Employment Agreement, dated June 10, 2014, by and between the Registrant and Jon Kessler. S-1 333-196645 10.24 June 10, 2014 10.10† Employment Agreement, dated June 10, 2014, by and between the Registrant and Stephen D. Neeleman, M.D. S-1 333-196645 10.25 June 10, 2014 10.11† Employment Agreement, dated June 10, 2014, by and between the Registrant and Darcy Mott. S-1 333-196645 10.26 June 10, 2014 10.12 Lease Agreement, dated May 15, 2015, by and between the Registrant and BG Scenic Point Office 2, L.C. 10-Q 001-36568 10.1 June 11, 2015 10.13 Amended and Restated Lease Agreement, dated May 15, 2015, by and between the Registrant and BG Scenic Point Office 1, L.C. 10-Q 001-36568 10.2 June 11, 2015 10.14† Offer letter to Robert W. Selander, dated September 28, 2015. 8-K 001-36568 10.1 September 30, 2015 10.15 First Amendment to Lease Agreement, dated November 3, 2015, by and between the Company and the Landlord. 10-Q 001-36568 10.1 December 8, 2016 10.16 Second Amendment to Lease Agreement, dated September 16, 2016, by and between the Company and the Landlord. 10-Q 001-36568 10.2 December 8, 2016 10.17 First Amendment to Amended and Restated Lease Agreement, dated June 1, 2016, by and between the Company and the Landlord. 10-Q 001-36568 10.1 June 8, 2017 10.18 Second Amendment to Amended and Restated Lease Agreement, dated May 31, 2017, by and between the Company and the Landlord. 10-Q 001-36568 10.2 June 8, 2017 -84- Table of Contents Incorporated by reference Exhibit no. Description Form File No. Exhibit Filing Date 10.19† Amended and Restated Non-Employee Director Compensation Policy 10-K 001-36568 10.25 March 28, 2018 10.20† Employment Agreement, dated June 1, 2018, by and between the Registrant and Angelique Hill 10-Q 001-36568 10.1 June 7, 2018 10.21† Employment Agreement, dated May 15, 2018, by and between the Registrant and Edward R. Bloomberg 10-Q 001-36568 10.1 September 6, 2018 10.22† HealthEquity, Inc. Amended and Restated Executive Change in Control Severance Plan 10-Q 001-36568 10.3 September 6, 2018 10.23 Lease Agreement, dated September 27, 2018, by and between the Company and the Landlord 10-Q 001-36568 10.1 December 6, 2018 10.24 Third Amendment to Amended and Restated Lease Agreement, dated September 27, 2018, by and between the Company and the Landlord 10-Q 001-36568 10.2 December 6, 2018 10.25 Fourth Amendment to Lease Agreement, dated September 27, 2018, by and between the Company and the Landlord 10-Q 001-36568 10.3 December 6, 2018 10.26† Restricted Stock Unit Award Agreement 10-Q 001-36568 10.4 December 6, 2018 10.27 Employment Agreement, dated April 5, 2018, by and between the Registrant and Ashley Dreier 10-K 001-36568 10.29 March 28, 2019 10.28 Restricted Stock Award Agreement 10-K 001-36568 10.30 March 28, 2019 10.29 Third Amendment to Lease Agreement, dated September 26, 2018, by and between the Company and the Landlord 10-K 001-36568 10.31 March 28, 2019 10.30 Amended and Restated Non-Employee Director Compensation Policy 10-K 001-36568 10.32 March 28, 2019 10.31 Agreement and Plan of Merger, dated as of June 26, 2019, by and among HealthEquity, Inc., WageWorks, Inc. and Pacific Merger Sub Inc. 8-K 001-36568 2.1 June 27, 2019 10.32 Credit Agreement, dated as of August 30, 2019, among HealthEquity, Inc., as borrower, each lender from time to time party thereto, Wells Fargo Bank, N.A., as administrative agent and the swing line lender, and each L/C Issuer party thereto 8-K 001-36568 10.1 August 30, 2019 10.33† Form of Indemnification Agreement entered into between WageWorks, Inc., its affiliates and its former directors and officers S-1 333-173709 10.1 July 19, 2011 10.34 HealthEquity, Inc. and WageWorks, Inc. 2010 Equity Incentive Plan (Amended and Restated in August 2019) 8-K 001-36568 10.2 August 30, 2019 10.35 Amendment No. 1 to the HealthEquity 2014 Equity Incentive Plan, as amended and restated 8-K 001-36568 10.3 August 30, 2019 10.36 Forms of Stock Option Agreements under the HealthEquity, Inc. and WageWorks, Inc. Amended and Restated 2010 Equity Incentive Plan S-1 333-173709 10.3 July 19, 2011 10.37 Transition, Separation and Release Agreement between the Company and Ashley Dreier, dated February 13, 2020. 10-Q 001-36568 10.1 June 4, 2020 10.38 Amendment No. 1 to Employment Agreement between the Company and Jon Kessler, dated April 1, 2017 10-Q 001-36568 10.2 June 4, 2020 -85- Table of Contents Incorporated by reference Exhibit no. Description Form File No. Exhibit Filing Date 10.39 Transition and Separation Agreement between the Company and Darcy Mott, dated June 25, 2020. 10-Q 001-36568 10.1 September 9, 2020 10.40 Stock Purchase Agreement, by and among HealthEquity, Inc., the Sellers Listed on Schedule I and Evan McCordick, dated March 8, 2021. 8-K 001-36568 2.1 March 8, 2021 21.1+ List of Subsidiaries 23.1+ Consent of PricewaterhouseCoopers LLP, Independent Registered Public Accounting Firm. 24.1+ Power of Attorney (included in the signature page to this Annual Report). 31.1+ Certification of the Principal Executive Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 31.2+ Certification of the Principal Financial Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 32.1*# Certification of the Principal Executive Officer Pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 32.2*# Certification of the Principal Financial Officer Pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 101.INS†† XBRL Instance document 101.SCH†† XBRL Taxonomy schema linkbase document 101.CAL†† XBRL Taxonomy calculation linkbase document 101.DEF†† XBRL Taxonomy definition linkbase document 101.LAB†† XBRL Taxonomy labels linkbase document 101.PRE†† XBRL Taxonomy presentation linkbase document 104 The cover page from the Company’s Annual Report on Form 10-K for the fiscal year ended January 31, 2021, formatted in Inline XBRL. + Filed herewith * Furnished herewith # These certifications are not deemed filed with the Securities and Exchange Commission and are not to be incorporated by reference in any filing the registrant makes under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, irrespective of any general incorporation language in any filings. † Indicates management contract or compensatory plan. †† In accordance with Rule 406T of Regulation S-T, the information in these exhibits is furnished and deemed not filed or part of a registration statement or prospectus for purposes of sections 11 or 12 of the Securities Act of 1933, is deemed not filed for purposes of Section 18 of the Exchange Act of 1934, and otherwise is not subject to liability under these sections. Item 16. Form 10-K Summary None. -86- Table of Contents Signatures Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this Annual Report on Form 10-K to be signed on its behalf by the undersigned, thereunto duly authorized in the City of Draper, State of Utah on this 31st day of March, 2020. HEALTHEQUITY, INC. Date: March 31, 2021 By: /s/ Jon Kessler Name: Jon Kessler Title: President and Chief Executive Officer -87- Table of Contents Power of attorney KNOW ALL PERSONS BY THESE PRESENT, that each person whose signature appears below hereby constitutes and appoints Jon Kessler and Darcy Mott, and each of them acting individually, as his or her true and lawful attorneys-in-fact and agents, with full power of each to act alone, with full powers of substitution and resubstitution, for him or her and in his or her name, place and stead, in any and all capacities, to sign any and all amendments to this Annual Report on Form 10-K with all exhibits thereto and all documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, with full power of each to act alone, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully for all intents and purposes as he or she might or could do in person, hereby ratifying and confirming all that said attorneys-in-fact and agents, or his or her or their substitutes, may lawfully do or cause to be done by virtue hereof. Pursuant to the requirements of the Securities Exchange Act of 1934, this Annual Report on Form 10-K has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated. Date: March 31, 2021 By: /s/ Robert W. Selander Name: Robert W. Selander Title: Chairman of the Board, Director Date: March 31, 2021 By: /s/ Jon Kessler Name: Jon Kessler Title: President and Chief Executive Officer (Principal Executive Officer), Director Date: March 31, 2021 By: /s/ Darcy Mott Name: Darcy Mott Title: Executive Vice President and Chief Financial Officer (Principal Financial and Accounting Officer) Date: March 31, 2021 By: /s/ Frank A. Corvino Name: Frank A. Corvino Title: Director Date: March 31, 2021 By: /s/ Adrian T. Dillon Name: Adrian T. Dillon Title: Director Date: March 31, 2021 By: /s/ Evelyn Dilsaver Name: Evelyn Dilsaver Title: Director Date: March 31, 2021 By: /s/ Debra McCowan Name: Debra McCowan Title: Director Date: March 31, 2021 By: /s/ Stuart B. Parker Name: Stuart B. Parker Title: Director Date: March 31, 2021 By: /s/ Stephen D. Neeleman, M.D. Name: Stephen D. Neeleman, M.D. Title: Director Date: March 31, 2021 By: /s/ Ian Sacks Name: Ian Sacks Title: Director Date: March 31, 2021 By: /s/ Gayle Wellborn Name: Gayle Wellborn Title: Director -88-