2 unchanged sentences
We maintain disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended, (the “Exchange Act”) that are designed to ensure that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and to ensure that information required to be disclosed is accumulated and communicated to our management, including our Principal Executive Officer and Principal Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure.
−Removed: Our management, with the participation of our Principal Executive Officer and Principal Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of June 30, 2023, the end of the period covered by this Quarterly Report.
−Removed: Based on this evaluation, our Principal Executive Officer and Principal Financial Officer concluded that our disclosure controls and procedures were not effective as of June 30, 2023 due to the material weaknesses in our internal control over financial reporting, described below.
+Added: Our management, with the participation of our Principal Executive Officer and Principal Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of September 30, 2023, the end of the period covered by this Quarterly Report.
+Added: Based on this evaluation, our Principal Executive Officer and Principal Financial Officer concluded that our disclosure controls and procedures were not effective as of September 30, 2023 due to the material weaknesses in our internal control over financial reporting, described below.
However, after giving full consideration to the material weaknesses, management believes that our condensed consolidated financial statements included in this Quarterly Report on Form 10-Q have been prepared in accordance with US GAAP.
2 unchanged sentences
A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.
−Removed: We have identified the following material weaknesses in our internal control over financial reporting, which remain outstanding as of June 30, 2023.
+Added: We have identified the following material weaknesses in our internal control over financial reporting, which remain outstanding as of September 30, 2023.
Westrock did not design and maintain effective controls in response to the risks of material misstatement as changes to existing controls or the implementation of new controls were not sufficient to respond to changes to the risks of material misstatement to financial reporting.
27 unchanged sentences
● Hired additional accounting and IT personnel, including a new chief accounting officer hired in May 2021, a new technical accounting resource hired in April 2022, a new IT compliance resource hired in March 2023, and a new internal controls resource hired in April 2023 with the appropriate level of knowledge, training, and experience to improve our internal control over financial reporting and IT capabilities.
−Removed: ● Developing and formalizing a risk assessment process across the organization to identify risks and design new controls or enhance existing controls responsive to such risks to ensure timely and accurate financial reporting based on criteria established in Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework).
+Added: ● Developing and formalizing a risk assessment process across the organization to identify risks and design new controls or enhance existing controls responsive to such risks to ensure timely and accurate financial reporting based on criteria established in Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (“COSO Framework”).
+Added: Entity level controls necessary to support management’s risk assessment and a process to evaluate the control environment in accordance with the COSO Framework were improved or implemented throughout 2023.
+Added: Management is at various stages of designing or implementing additional controls that would further improve risk assessment.
● Engaged a third party to assist in designing and implementing controls related to period-end financial reporting, segregation of duties and IT general controls.
−Removed: ● Designed and implemented controls to formalize roles and review responsibilities to align with Westrock’s team’s skills and experience and designing and implementing controls over segregation of duties.
−Removed: ● Designing and implementing formal accounting procedures and controls supporting Westrock’s period-end financial reporting process, including controls over the preparation and review of account reconciliations and journal entries.
−Removed: ● Enhancing policies and procedures related to the management and approval of (i) changes in our IT environment, including procedures to review changes in IT data and the configuration of systems, (ii) system implementations and projects to ensure adequate governance, development, change management, and implementation controls, (iii) security access, including policies and procedures to set up or remove users to our IT systems, (iv) periodic security access reviews of our key financial systems’ users to ensure the appropriateness of their roles and security access levels, and (v) review of service organization reports and related end-user control considerations.
−Removed: ● Designing and implementing IT general controls, including controls over change management, the review and update of user access rights and privileges, controls over batch jobs and data backups, and program development approvals and testing.
+Added: ● Designed and implemented controls during the quarters ended June 30, and September 30, 2023 to formalize roles and review responsibilities to align with Westrock’s team’s skills and experience and designing and implementing controls over segregation of duties that include workflow automation and documentation, task reassignment, and policies and procedures enhancement around the preparation, review and oversight of account reconciliations and journal entries.
+Added: Management is at various stages of
+Added: designing and implementing other controls that would further enhance segregation of duties around month-end close procedures.
+Added: ● Designed and implemented formal accounting procedures and controls during the quarter ended September 30, 2023 that support Westrock’s period-end financial reporting process, including controls over close procedures workflow, the preparation, review and oversight of account reconciliations and journal entries, evaluation of internal information for disclosure, and controls to reconcile financial statement and disclosure information to source documentation.
+Added: Management is in the initial stages of designing other controls that would further improve period-end financial reporting.
+Added: ● During the quarter ended September 30, 2023, enhanced policies and procedures related to the management and approval of (i) changes in our IT environment, including procedures to review changes in IT data and the configuration of systems, (ii) system implementations and projects to ensure adequate governance, development, change management, and implementation controls, (iii) security access, including policies and procedures to set up or remove users to our IT systems, (iv) periodic security access reviews of our key financial systems’ users to ensure the appropriateness of their roles and security access levels, and (v) review of service organization reports and related end-user control considerations.
+Added: ● Designed and implemented IT general controls, including controls over change management, the review and update of user access rights and privileges, controls over batch jobs and data backups, and program development approvals and testing for most IT systems during the quarter ended September 30, 2023.
+Added: Enhancements of IT general controls around remaining IT systems are in various stages of design and implementation.
+Added: The enhancements are expected to remediate the material weaknesses described above when each is fully implemented and operating effectively.
Changes in Internal Control Over Financial Reporting
−Removed: There were no other changes in our internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act, during the quarter ended June 30, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.
+Added: As described above in the Remediation Plans section, there were changes during the quarter ended September 30, 2023, in our internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.
Other Information
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.