Item 4. Controls and Procedures
Item 4. Controls and Procedures
Evaluation of Disclosure Controls and Procedures
We maintain disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended, (the “Exchange Act”) that are designed to provide reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and to ensure that information required to be disclosed is accumulated and communicated to our management, including our Principal Executive Officer and Principal Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure.
Our management, with the participation of our Principal Executive Officer and Principal Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of June 30, 2022, the end of the period covered by this Quarterly Report. Based on this evaluation, our Principal Executive Officer and Principal Financial Officer concluded that our disclosure controls and procedures were not effective as of June 30, 2022 due to the material weaknesses in our internal control over financial reporting, described below.
Material Weaknesses in Internal Control Over Financial Reporting
A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis. We have identified the following material weaknesses in our internal control over financial reporting, which remain outstanding as of June 30, 2022.
Westrock did not design and maintain effective controls in response to the risks of material misstatement as changes to existing controls or the implementation of new controls were not sufficient to respond to changes to the risks of material misstatement to financial reporting. This material weakness in risk assessment contributed to the following material weaknesses:
● Westrock did not design and maintain effective controls to address the identification of and accounting for certain non-routine, unusual or complex transactions, including the proper application of U.S. GAAP to such transactions. Specifically, Westrock did not design and maintain effective controls to timely identify and account for issuances of redeemable common equivalent preferred units, the S&D acquisition transaction, a disposal transaction, and arrangements with forward repurchase obligations which resulted in material audit adjustments to shareholders’ deficit; intangible assets, net; goodwill; acquisition, restructuring and integration expense; and impairment charges; within the consolidated financial statements as of and for the year ended December 31, 2020 and in immaterial misstatements to revenue; costs of sales; interest expense; inventory; accrued expenses and other current liabilities; and the cash flow presentation between operating and financing activities within the consolidated financial statements as of and for the years ended December 31, 2021 and 2020.
● Westrock did not design and maintain effective controls over the period-end financial reporting process to achieve complete and accurate financial accounting, reporting and disclosures, including the presentation and classification of various accounts in the financial statements, which resulted in immaterial adjustments to product revenues; product costs of sales; selling, general and administrative expense; loss on disposal of
44
Table of Contents
property, plant and equipment; other (income) expense, net; accounts receivable, net, inventories; derivative assets, net; prepaid expenses and other current assets; property, plant, and equipment, net; goodwill; intangible assets, net; other long-term assets; accounts payable; accrued expenses and other current liabilities and the cash flow presentation of debt payments and proceeds within financing activities within the consolidated financial statements as of and for the year ended December 31, 2020.
● Westrock did not design and maintain effective controls related to ensuring appropriate segregation of duties as it relates to the preparation and review of journal entries and account reconciliations, which did not result in adjustments to the consolidated financial statements.
● Westrock did not design and maintain effective controls over certain information technology (“IT”) or general computer controls for information systems that are relevant to the preparation of the consolidated financial statements. Specifically, Westrock did not design and maintain: (i) program change management controls to ensure that IT program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; (ii) user access controls to ensure appropriate segregation of duties and adequate restricted user and privileged access to financial applications, data and programs to the appropriate personnel; (iii) computer operations controls to ensure that data backups are authorized and monitored; and (iv) testing and approval controls for program development to ensure that new software development is aligned with business and IT requirements. These IT deficiencies did not result in adjustments to the consolidated financial statements. However, the deficiencies, when aggregated, could impact the Westrock’s ability to maintain effective segregation of duties, as well as the effectiveness of IT-dependent controls (such as automated controls that address the risk of material misstatement to one or more assertions, along with the IT controls and underlying data that support the effectiveness of system-generated data and reports) that could result in misstatements potentially impacting all financial statement accounts and disclosures that would result in a material misstatement to the annual or interim financial statements that would not be prevented or detected. Accordingly, it was determined these deficiencies in the aggregate constitute a material weakness.
Additionally, each of these material weaknesses could result in a misstatement of substantially all of Westrock’s accounts or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.
Management believes that our condensed consolidated financial statements included in this Quarterly Report on Form 10-Q have been prepared in accordance with US GAAP. Our Principal Executive Officer and Principal Financial Officer have certified that, based on such officer’s knowledge, the condensed consolidated financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this report.
Remediation Plans
Westrock has taken and is taking certain measures to remediate the material weaknesses described above, including the following:
● Hiring additional accounting and IT personnel, including a new chief accounting officer hired in May 2021 and a new technical accounting resource hired in April 2022, with the appropriate level of knowledge, training, and experience to improve our internal control over financial reporting and IT capabilities.
● Developing and formalizing a risk assessment process across the organization to identify risks and design new controls or enhance existing controls responsive to such risks to ensure timely and accurate financial reporting.
● Formally assessing non-routine, unusual and complex accounting transactions, as well as other technical accounting and financial reporting matters including controls over the preparation and review of accounting
45
Table of Contents
memoranda addressing these matters. During the quarter ended June 30, 2022, we implemented controls to identify non-routine, unusual and complex accounting transactions and require that the accounting implications of such transactions are formally assessed, documented and reviewed by a relevant senior member of our accounting team in a timely manner. In addition, we have engaged third party subject matter experts to advise us with respect to certain complex non-routine transactions in addition to management’s review of such transactions, where appropriate.
● Engaging a third party to assist in designing and implementing controls related to period-end financial reporting, segregation of duties and IT general controls.
● Designing and implementing controls to formalize roles and review responsibilities to align with Westrock’s team’s skills and experience and designing and implementing controls over segregation of duties.
● Designing and implementing formal accounting procedures and controls supporting Westrock’s period-end financial reporting process, including controls over the preparation and review of account reconciliations and journal entries.
● Enhancing policies and procedures related to the management and approval of (i) changes in our IT environment, including procedures to review changes in IT data and the configuration of systems, (ii) system implementations and projects to ensure adequate governance, development, change management, and implementation controls, (iii) security access, including policies and procedures to set up or remove users to our IT systems, (iv) periodic security access reviews of our key financial systems’ users to ensure the appropriateness of their roles and security access levels, and (v) review of service organization reports and related end-user control considerations.
● Designing and implementing IT general controls, including controls over change management, the review and update of user access rights and privileges, controls over batch jobs and data backups, and program development approvals and testing.
Changes in Internal Control Over Financial Reporting
Other than the implementation of controls related to the accounting for non-routine, unusual or complex transactions described above, there were no changes in our internal control over financial reporting, as such term is defined in Rule 13a-15(f) under the Exchange Act, that occurred during the three months ended June 30, 2022 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.
Part II. Other Information