What changed in this filing

/stocks — the workspaceLOADING

Item 4. Controls and Procedures

2022-06-08 compared with 2021-12-09 · 14 added, 39 removed, 23 unchanged (70% of the section changed)

1 unchanged sentence

Evaluation of Disclosure Controls and Procedures

Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of October 31, 2021, the end of the period covered by this Quarterly Report on Form 10-Q.

Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of April 30, 2022, the end of the period covered by this Quarterly Report on Form 10-Q.

The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms.

Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the

information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure.

Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure.

Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on such evaluation, the CEO and CFO have concluded that as of October 31, 2021, the Company’s disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting described below.

Based on such evaluation, the CEO and CFO have concluded that as of April 30, 2022, the Company’s disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting described below.

Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses described below, management has concluded that the condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America.

In accordance with interpretive guidance issued by SEC staff, companies are allowed to exclude acquired businesses from the assessment of internal control over financial reporting during the first year after completion of an acquisition and from the assessment of disclosure controls and procedures to the extent subsumed in such internal control over financial reporting.

In accordance with this guidance, as the Company acquired Luum on March 8, 2021, management's evaluation and conclusion as to the effectiveness of the Company's disclosure controls and procedures as of October 31, 2021 excluded the portion of disclosure controls and procedures that are subsumed by internal control over financial reporting of Luum.

Luum’s assets and revenues represented approximately 1%, excluding the effects of purchase accounting, of the Company's consolidated total assets and consolidated total revenues as of and for the fiscal quarter ended October 31, 2021.

In accordance with this guidance, as the Company acquired Further on

November 1, 2021, management's evaluation and conclusion as to the effectiveness of the Company's disclosure controls and procedures as of April 30, 2022 excluded the portion of disclosure controls and procedures that are subsumed by internal control over financial reporting of Further.

Further represented approximately 1% of assets and approximately 8% of revenues, excluding the effects of purchase accounting, of the Company's consolidated total assets and consolidated total revenues as of and for the fiscal quarter ended April 30, 2022.

Material Weaknesses in Internal Control over Financial Reporting

Management identified certain deficiencies in WageWorks' internal control over financial reporting that aggregated to material weaknesses in the following components of the Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO Framework”):

Risk Assessment – The WageWorks subsidiary did not sufficiently identify and analyze risks arising from changes in the business environment, including risks arising in connection with the integration of acquisitions and financial system implementations.

Information and Communication – The WageWorks subsidiary did not establish cross-functional procedures and policies relating to effective information and communication necessary to support the functioning of internal control over financial reporting.

Monitoring – The WageWorks subsidiary did not implement effective monitoring controls that were responsive to changes in the business or the timely remediation of identified control deficiencies.

The COSO Framework component material weaknesses described above contributed to deficiencies at the control activity level that aggregated to the material weaknesses described below:

Accounting Close and Financial Reporting

The WageWorks subsidiary had inadequate process level and monitoring controls in the area of accounting close and financial reporting specifically, but not exclusively, around the review of account reconciliations, completeness and accuracy of data material to financial reporting, accounting estimates and related cut-off, the establishment, review, and implementation of accounting policies, and the review of the accuracy and completeness of certain manual and complex data feeds into journal entries and reconciliations of high-volume standard transactions.

As previously disclosed, management identified certain deficiencies in the Company’s internal control over financial reporting that aggregated to material weaknesses in the following areas:

Contract to Cash Process

5 unchanged sentences

Ongoing Integration and Remediation Efforts

Management has assessed the impact of the acquisition of WageWorks on the Company’s internal control over financial reporting and continues to assess changes driven by the integration of WageWorks with the existing operations at the consolidated Company.

As part of this assessment, management has continued to evaluate the Company’s internal control environment to ensure that it has appropriate controls in place to mitigate the risks of a material misstatement to its consolidated financial statements associated with the WageWorks subsidiary and the Company as a whole.

In response to the COSO Framework component material weaknesses in the WageWorks subsidiary’s internal control over financial reporting, management has taken the following actions:

• performed its recurring risk assessment and scoping of key systems and business processes, including a risk assessment at the financial statement assertion level to ensure that the level of precision of relevant controls is adequate to address the identified risks;

• dedicated certain senior finance, accounting, operational, and IT leadership team members to work on remediation efforts and appointed third-party internal controls advisors to assist with such efforts;

• implemented a periodic assessment to monitor business changes impacting accounting processes and controls;

• incorporated certain WageWorks processes into the Company’s existing entity-level controls;

• established periodic reporting of the remediation plan progress to the Audit and Risk Committee of the Company's board of directors;

• formalized documentation underlying processes and controls to promote knowledge and information transfer across functions and upon personnel changes;

• continued to monitor the operating effectiveness of the existing entity-level controls.

Although we have implemented the remediation plans detailed above, certain of these controls have not yet operated in the current fiscal year for us to evaluate if the material weakness has been remediated.

In response to the material weakness “A.

Accounting Close and Financial Reporting,” management has taken the following actions:

• incorporated certain WageWorks processes into the Company’s process-level controls, including, but not limited to, those that address the monitoring of the accounting close cycle and enhanced the evaluation of accounting policies;

• redesigned certain processes and controls in conjunction with the enterprise resource planning “ERP” system migration described below;

• formalized the assessment of the relevancy of information and data used in key controls, including a plan to design or augment controls to incorporate the review of the accuracy and completeness of such items;

• continued to monitor the operating effectiveness of the process-level and redesigned controls.

Although we have implemented the remediation plan detailed above, these controls have not been in place and operating for a sufficient period of time for us to evaluate if the material weakness has been remediated.

In response to the material weakness “B.

Contract to Cash Process,” management has taken the following actions:

• continued to execute its plan to consolidate service platforms related to the contract-to-cash cycle, which will reduce a significant number of manual business process controls;

• enhanced the design of existing controls including information and data used in controls, where applicable, and began implementing additional controls to further strengthen the control environment;

• implemented a process to assess the design and monitor the operating effectiveness of the redesigned controls.

In response to the material weakness “C.

• enhanced the design of existing controls and implemented additional controls to further strengthen the control environment;

• continued to formalize the assessment of the relevancy of information and data used in key controls, including the incorporation of the review of the accuracy and completeness of such items;

• continued to execute the process to assess the design and monitor the operating effectiveness of the redesigned controls.

In response to the material weakness “B.

Information Technology General Controls,” management has taken the following actions:

1 unchanged sentence

• enhanced the design of existing controls, where applicable, and implemented additional controls to further strengthen the control environment;

• implemented a process to assess and enhance the design and monitor the operating effectiveness of controls related to logical access and change management for relevant applications and systems.

• continued to execute the process to assess and enhance the design and monitor the operating effectiveness of controls related to logical access and change management for relevant applications and systems;

• continued training of control owners on the appropriate evidence and documentation for IT dependencies and logical access controls.

As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plans described above.

As part of our integration efforts, we have migrated all of our material operations to a single ERP system for the consolidated Company that will enhance our business and financial processes and standardize our information systems.

We have re-assessed risks in response to the ERP system migration and the associated changes to underlying processes.

We have redesigned certain controls in response to the current risks and continue to monitor the operating effectiveness of the redesigned controls.

Changes in Internal Control Over Financial Reporting

Other than continuing to make progress on the ongoing integration and remediation efforts described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended October 31, 2021 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other than continuing to make progress on the ongoing integration and remediation efforts described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended April 30, 2022 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

Part II—Other Information

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 4. Controls and Procedures