Lumber Liquidators 2015 Annual Report Download - page 93

Management, with the participation of the Company’s principal executive and principal financial officer,
conducted an evaluation of the effectiveness of our internal control over financial reporting as of
December 31, 2015 based on the framework and criteria established in Internal Control — Integrated
Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. This
evaluation included review of the documentation of controls, evaluation of the design effectiveness of controls,
testing of the operating effectiveness of controls and a conclusion on this evaluation. Based on the foregoing,
management concluded that the Company’s internal control over financial reporting was not effective as of
December 31, 2015 for the reasons described below.
In the course of completing its assessment of internal control over financial reporting as of December 31,
2015, management identified deficiencies related to the design and operating effectiveness of its information
technology (‘‘IT’’) general controls for the Company’s enterprise resource planning system (referred to
hereinafter as the ‘‘ERP system’’). The ERP system is utilized in the performance of transactional and
management review controls that comprise the principal element of the Company’s system of internal control
over financial reporting and are relevant to the preparation of its consolidated financial statements. These
deficiencies involve user access controls that are intended to ensure that access and revisions to financial
applications and data is adequately restricted to appropriate personnel. The ineffective user access controls
resulted in ineffective segregation of duties within the Company’s IT environment, whereby certain personnel
and contractors have the capability to perform conflicting duties within the ERP system. Finally, the Company
did not maintain effective controls over certain periodic reviews of user access. As a result of the aggregate
deficiencies identified, there is a reasonable possibility that the effectiveness of business process controls that
utilize electronic data and financial reports generated from the affected ERP system could be adversely
affected. While these control deficiencies did not result in any audit adjustments, these control deficiencies
could result in a material misstatement to the annual or interim consolidated financial statements and
disclosures that would not be prevented or detected on a timely basis. Accordingly, management has
concluded that these control deficiencies constitute a material weakness. Therefore, management has
concluded that, as of December 31, 2015, there was a material weakness in internal control over financial
reporting related to information technology general controls in the area of user access for the Company’s
ERP system. A material weakness is a deficiency, or a combination of deficiencies, in internal control over
financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or
interim financial statements will not be prevented or detected on a timely basis.
Our internal control over financial reporting as of December 31, 2015 has been audited by Ernst &
Young LLP, an independent registered public accounting firm, as stated in their report, which follows below.
(c) Remediation Activities
We are actively engaged in the implementation of a remediation plan to ensure that controls contributing
to this material weakness are designed appropriately and will operate effectively. The remediation actions we
are taking and expect to take include the following:
— Improving the design, operation and monitoring of control activities and procedures associated with
user and administrator access to the affected IT system, including both preventive and detective
control activities;
— Standardize the assignment of user access roles and responsibilities within the Company’s ERP
system;
— Reviewing the responsibilities in the functional areas that support and monitor our IT systems
Management believes that these efforts will effectively remediate the material weakness. However, the
material weakness in our internal control over financial reporting will not be considered remediated until the
new controls are fully implemented, in operation for a sufficient period of time, and tested and concluded by
management to be designed and operating effectively. We cannot provide any assurance that these remediation
efforts will be successful or that our internal control over financial reporting will be effective as a result of
these efforts. In addition, as the Company continues to evaluate and work to improve its internal control over
financial reporting within the area of IT general controls, management may determine to take additional
measures to address control deficiencies or determine to modify the remediation plan described above.
83