HEALTHEQUITY, INC. 10-Q

Item 4. Controls and Procedures Evaluation of Disclosure Controls and Procedures Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of April 30, 2022, the end of the period covered by this Quarterly Report on Form 10-Q. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based on such evaluation, the CEO and CFO have concluded that as of April 30, 2022, the Company’s disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting described below. Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses described below, management has concluded that the condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America. In accordance with interpretive guidance issued by SEC staff, companies are allowed to exclude acquired businesses from the assessment of internal control over financial reporting during the first year after completion of an acquisition and from the assessment of disclosure controls and procedures to the extent subsumed in such internal control over financial reporting. In accordance with this guidance, as the Company acquired Further on -31- Table of Contents November 1, 2021, management's evaluation and conclusion as to the effectiveness of the Company's disclosure controls and procedures as of April 30, 2022 excluded the portion of disclosure controls and procedures that are subsumed by internal control over financial reporting of Further. Further represented approximately 1% of assets and approximately 8% of revenues, excluding the effects of purchase accounting, of the Company's consolidated total assets and consolidated total revenues as of and for the fiscal quarter ended April 30, 2022. Material Weaknesses in Internal Control over Financial Reporting As previously disclosed, management identified certain deficiencies in the Company’s internal control over financial reporting that aggregated to material weaknesses in the following areas: A. Contract to Cash Process The Company did not have effective controls around the contract-to-cash life cycle of service fees, including ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements that require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, availability of customer contracts, and reviews of non-standard contracts. B. Information Technology General Controls The Company did not have effective controls related to information technology general controls (ITGCs) in the areas of logical access and change management over certain information technology systems that supported its financial reporting processes. The Company's business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. These material weaknesses resulted in material misstatements of WageWorks' historical financial statements, which preceded the acquisition, and could result in a misstatement of our account balances or disclosures that would result in a material misstatement to the annual or interim condensed consolidated financial statements that would not be prevented or detected. Ongoing Integration and Remediation Efforts In response to the material weakness “A. Contract to Cash Process,” management has taken the following actions: • continued to execute its plan to consolidate service platforms related to the contract-to-cash cycle, which will reduce a significant number of manual business process controls; • enhanced the design of existing controls and implemented additional controls to further strengthen the control environment; • continued to formalize the assessment of the relevancy of information and data used in key controls, including the incorporation of the review of the accuracy and completeness of such items; and • continued to execute the process to assess the design and monitor the operating effectiveness of the redesigned controls. In response to the material weakness “B. Information Technology General Controls,” management has taken the following actions: • continued to execute its plan to consolidate service platforms, which will reduce the number of ITGCs in the areas of logical access and change management; • enhanced the design of existing controls, where applicable, and implemented additional controls to further strengthen the control environment; • continued to execute the process to assess and enhance the design and monitor the operating effectiveness of controls related to logical access and change management for relevant applications and systems; and • continued training of control owners on the appropriate evidence and documentation for IT dependencies and logical access controls. As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plans described above. -32- Table of Contents Changes in Internal Control Over Financial Reporting Other than continuing to make progress on the ongoing integration and remediation efforts described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended April 30, 2022 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting. -33- Part II—Other Information