What changed in this filing

/stocks — the workspaceLOADING

Item 9A. Controls and Procedures

2023-03-30 compared with 2022-03-31 · 38 added, 69 removed, 189 unchanged (36% of the section changed)

5 unchanged sentences

Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on such evaluation, our CEO and our CFO have concluded that as of January 31, 2022, the Company's disclosure controls and procedures were not effective because of the material weaknesses in internal control over financial reporting described below.

Notwithstanding the ineffective disclosure controls and procedures as a result of the identified material weaknesses described below, management has concluded that the consolidated financial statements included elsewhere in this Annual Report on Form 10-K present fairly, in all material respects, the Company’s financial position, results of operations and cash flows in accordance with generally accepted accounting principles in the United States of America.

In accordance with interpretive guidance issued by SEC staff, companies are allowed to exclude acquired businesses from the assessment of internal control over financial reporting during the first year after completion of an acquisition and from the assessment of disclosure controls and procedures to the extent subsumed in such internal control over financial reporting.

In accordance with this guidance, as the Company acquired Luum on March 8, 2021, and Further on November 1, 2021, management's evaluation and conclusion as to the effectiveness of the Company's disclosure controls and procedures as of January 31, 2022 excluded the portion of disclosure controls and procedures that are subsumed by internal control over financial reporting of Luum and Further.

The balances resulting from these acquisitions represented less than 1% of assets and approximately 3% of revenues, excluding the effects of purchase accounting, of the Company's consolidated total assets and consolidated total revenues as of and for the fiscal year ended January 31, 2022.

Based on such evaluation, our CEO and our CFO have concluded that as of January 31, 2023, the Company's disclosure controls and procedures were effective at the reasonable assurance level.

Management's report on internal control over financial reporting

4 unchanged sentences

Management assessed the effectiveness of the Company’s internal control over financial reporting as of January 31, 2023 based on criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control - Integrated Framework (2013) (“COSO Framework”) .

Based on that assessment, management has concluded that, as of January 31, 2022, due to material weaknesses in internal control over financial reporting the Company’s internal control over financial reporting was not effective.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

In accordance with interpretive guidance issued by SEC staff, management has excluded Luum and Further from its assessment of internal control over financial reporting as of January 31, 2022, as the Company acquired Luum and Further during the fiscal year ended January 31, 2022.

Based on that assessment, management has concluded that, as of January 31, 2023, the Company’s internal control over financial reporting was effective.

The Company’s independent registered public accounting firm, PricewaterhouseCoopers LLP, has audited the effectiveness of the Company’s internal control over financial reporting as of January 31, 2023.

Its report appears in Part II, Item 8 of this Annual Report on Form 10-K.

As previously disclosed, management identified certain deficiencies in the Company’s internal control over financial reporting that aggregated to material weaknesses in the following areas:

Contract to Cash Process

The Company did not have effective controls around the contract-to-cash life cycle of service fees, including ineffective process level controls around billing set-up during customer implementation, managing change to existing customer billing terms and conditions, timely termination of customers, implementing complex and/or non-standard billing arrangements that require manual intervention or manual controls for billing to customers, processing timely adjustments, lack of robust, established and documented policies to assess collectability and reserve for revenue, bad debts and accounts receivable, availability of customer contracts, and reviews of non-standard contracts.

Information Technology General Controls

The Company did not have effective controls related to information technology general controls ("ITGCs") in the areas of logical access and change management over certain information technology systems that supported its financial reporting processes.

The Company’s business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

These material weaknesses resulted in material misstatements of WageWorks' historical financial statements, which preceded the WageWorks Acquisition, and could result in a misstatement of our account balances or disclosures that would result in a material misstatement to the annual or interim condensed consolidated financial statements that would not be prevented or detected.

Remediation of Previously Reported Material Weakness

As previously reported, the WageWorks subsidiary had material weaknesses related to its risk assessment, information and communication, control activities, and monitoring components of the COSO Framework.

Additionally, WageWorks had a material weakness related to inadequate process level and monitoring controls in the area of accounting close and financial reporting.

During the year ended January 31, 2022, the Company completed the following remedial actions designed to address the previously identified material weaknesses in the COSO Framework components:

• incorporated certain WageWorks processes into the Company’s existing entity-level controls;

• performed its recurring risk assessment and scoping of key systems and business processes, including a risk assessment at the financial statement assertion level to ensure that the level of precision of relevant controls is adequate to address the identified risks;

• dedicated certain senior finance, accounting, operational, and IT leadership team members to work on remediation efforts and appointed third-party internal controls advisors to assist with such efforts;

• implemented a periodic assessment to monitor business changes impacting accounting processes and controls;

• reported periodic updates of the remediation plan progress to the Audit and Risk Committee of the Company's board of directors;

• formalized documentation underlying processes and controls to promote knowledge and information transfer across functions and upon personnel changes;

• monitored the operating effectiveness of the existing entity-level controls.

During the year ended January 31, 2022, the Company completed the following remedial actions designed to address the previously identified material weaknesses in accounting close and financial reporting:

• incorporated certain WageWorks processes into the Company’s process-level controls, including, but not limited to, those that address the monitoring of the accounting close cycle and enhanced the evaluation of accounting policies;

• redesigned certain processes and controls in conjunction with the enterprise resource planning (“ERP”) system migration described below;

• enhanced the design of existing controls, where applicable, and implemented additional controls to further strengthen the control environment;

As previously reported, the WageWorks subsidiary had material weaknesses related to process level and monitoring controls in the areas of the contract-to-cash process and information technology general controls (ITGCs).

During the fiscal year ended January 31, 2023, the Company completed the following remedial actions designed to address the previously identified material weakness in the contract-to-cash process:

• incorporated certain WageWorks processes into the Company’s process-level controls, including implementing complex and/or non-standard billing arrangements;

• executed its plan to consolidate service platforms related to the contract-to-cash cycle, which reduced a significant number of manual business process controls;

• completed its redesign of existing controls, where applicable, and implemented additional controls to further strengthen the control environment;

• formalized the assessment of the relevancy of information and data used in key controls, including the design or augmentation of controls to incorporate the review of the accuracy and completeness of such items;

• monitored the operating effectiveness of the existing entity-level controls.

During the fiscal year ended January 31, 2023, the Company completed the following remedial actions designed to address the previously identified material weakness in ITGCs:

• executed its plan to consolidate service platforms related to the contract-to-cash cycle, which reduced the number of ITGCs in the areas of logical access and change management;

• completed its redesign of existing controls, where applicable, and implemented additional controls to further strengthen the control environment;

• implemented enhancements to monitor design and operating effectiveness of controls related to logical access and change management for relevant applications and systems;

• implemented recurring training of control owners on the appropriate evidence and documentation for IT dependencies and logical access controls;

• monitored the operating effectiveness of the process-level and redesigned controls.

Management evaluated the design and operating effectiveness of the entity level and process level controls associated with the remediation activities above.

Management has concluded that such controls are operating effectively, and that the previously reported material weaknesses in the COSO Framework components and accounting close and financial reporting have been remediated as of January 31, 2022.

Ongoing Integration and Remediation Efforts

In response to the material weakness "A.

Contract to Cash Process", management has taken the following actions:

• continued to execute its plan to consolidate service platforms related to the contract-to-cash cycle, which will reduce a significant number of manual business process controls;

• enhanced the design of existing controls including information and data used in controls, where applicable, and are implementing additional controls to further strengthen the control environment;

• implemented a process to assess the design and monitor the operating effectiveness of the new and redesigned controls.

In response to the material weakness "B.

Information Technology General Controls", management has taken the following actions:

• continued to execute its plan to consolidate service platforms, which will reduce the number of ITGCs in the area of logical access and change management;

• enhanced the design of existing controls, where applicable, and implemented additional controls to further strengthen the control environment;

• implemented a process to assess and enhance the design and monitor the operating effectiveness of controls related to logical access and change management for relevant applications and systems.

As part of our integration efforts, we have migrated all of our material operations to a single ERP system for the consolidated Company which enhanced our business and financial processes and standardized our information systems.

We have re-assessed risks in response to the ERP system migration and the associated changes to underlying processes.

We redesigned certain controls in response to the current risks and evaluated the operating effectiveness of the redesigned controls.

As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plans described above.

Management evaluated the design and operating effectiveness of the process level controls associated with the remediation activities above.

Management has concluded that, as of January 31, 2023, such controls are operating effectively and the previously reported material weaknesses in the contract-to-cash process and ITGCs have been remediated.

Changes in Internal Control Over Financial Reporting

Other than as described above, there were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rules 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2022 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

There were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rules 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2023 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other information

31 unchanged sentences

Exhibit Filing Date

3.1 Amended and Restated Certificate of Incorporation of the Registrant

8-K 001-36568 3.2 July 6, 2018

3.2 Amended and Restated Bylaws of the Registrant

3.1 Amended and Restated Certificate of Incorporation of the Company

8-K 001-36568 3.2 July 6, 2018

4.1 Description of Securities of the Registrant

3.2 Amended and Restated By-laws of the Company

8-K 001-36568 3.1 February 10, 2023

4.1 Description of Securities of the Company

10-K 001-36568 4.1 March 31, 2020

1 unchanged sentence

S-1/A 333-196645 4.1 July 16, 2014

4.3 Amended and Restated Registration Rights Agreement, dated August 11, 2011, by and among the Registrant and certain of its stockholders.

4.3 Amended and Restated Registration Rights Agreement, dated August 11, 2011, by and among the Company and certain of its stockholders.

S-1 333-196645 4.2 June 10, 2014

1 unchanged sentence

8-K 001-36568 4.1 October 12, 2021

10.1 Form of Indemnification Agreement by and between the Registrant and its directors and officers.

10.1 Form of Indemnification Agreement by and between the Company and its directors and officers.

S-1/A 333-196645 10.1 July 16, 2014

31 unchanged sentences

S-1 333-196645 10.25 June 10, 2014

10.13† Employment Agreement, dated June 10, 2014, by and between the Company and Darcy Mott.

S-1 333-196645 10.26 June 10, 2014

10.14† Transition and Separation Agreement between the Company and Darcy Mott, dated June 25, 2020.

10-Q 001-36568 10.1 September 9, 2020

10.13† Employment Agreement, dated June 25, 2020, by and between the Company and Tyson Murdock

3 unchanged sentences

10.15† Employment Agreement, dated November 9, 2018, by and between the Company and Larry Trittschuh

10-K 001-36568 10.17 March 31, 2022

10.16† Amendment No.

1 to Employment Agreement, dated December 4, 2018, by and between the Company and Larry Trittschuh

10-K 001-36568 10.18 March 31, 2022

Incorporated by reference

3 unchanged sentences

2 to Employment Agreement, dated December 31, 2022, by and between the Company and Larry Trittschuh

10.18†+ Employment Agreement, dated January 19, 2022, by and between the Company and Elimelech Rosner

10.19 Lease Agreement, dated May 15, 2015, by and between the Registrant and BG Scenic Point Office 2, L.C.

18 unchanged sentences

10-Q 001-36568 10.3 December 6, 2018

10.29† Form of Indemnification Agreement entered into between WageWorks, Inc., its affiliates and its former directors and officers

S-1 333-173709 10.1 July 19, 2011

10.29 Credit Agreement, dated as of October 8, 2021, by and among the Company, as borrower, each lender from time to time party thereto, JPMorgan Chase Bank, N.A., as administrative agent and the Swing Line Lender (as defined therein), and each L/C Issuer (as defined therein) party thereto.

8-K 001-36568 10.1 October 12, 2021

10.31 Custodial Transfer and Asset Purchase Agreement, dated as of April 27, 2021, by and between Fifth Third Bank, National Association, and HealthEquity, Inc.

8-K 001-36568 2.1 April 27, 2021

10.32 Amended and Restated Asset and Unit Purchase Agreement, dated as of September 7, 2021, by and among Viking Acquisition Corp., HealthEquity, Inc., MII Life Insurance, Incorporated d/b/a Further and Aware Integrated, Inc.**

8-K 001-36568 2.1 September 8, 2021

10.30+ Non-Employee Director Compensation Policy

21.1 List of Subsidiaries

10-K 001-36568 21.1 March 31, 2022

23.1+ Consent of PricewaterhouseCoopers LLP, Independent Registered Public Accounting Firm.

24.1+ Power of Attorney (included in the signature page to this Annual Report).

31.1+ Certification of the Principal Executive Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

31.2+ Certification of the Principal Financial Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

Incorporated by reference

1 unchanged sentence

Exhibit Filing Date

31.1+ Certification of the Principal Executive Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

31.2+ Certification of the Principal Financial Officer Pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

32.1*# Certification of the Principal Executive Officer Pursuant to 18 U.S.C.

17 unchanged sentences

Form 10-K Summary

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this Annual Report on Form 10-K to be signed on its behalf by the undersigned, thereunto duly authorized in the City of Draper, State of Utah on this 31st day of March, 2022.

HEALTHEQUITY, INC.

17 unchanged sentences

March 30, 2023 By:

/s/ Paul Black

March 30, 2023 By:

/s/ Frank Corvino

10 unchanged sentences

March 30, 2023 By:

/s/ Stuart Parker

Stuart Parker

/s/ Rajesh Natarajan

Rajesh Natarajan

March 30, 2023 By:

3 unchanged sentences

March 30, 2023 By:

/s/ Stuart Parker

Stuart Parker

March 30, 2023 By:

/s/ Ian Sacks

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 9A. Controls and Procedures