SEC Comment Letter for OneSpan (OSPN) — Jul 1, 2009
OneSpan Inc.
Date: July 1, 2009 · CIK: 0001044777 · Accession: 0000000000-09-034979
AI Filing Summary & Sentiment
Referenced dates: June 17, 2005, May 26, 2005, May 26, 2005
Show Raw Text
Mail Stop 4561 June 30, 2009 T. Kendall Hunt CEO & Chairman of the BOD VASCO Data Security International, Inc. 1901 South Meyers Road Suite 210 Oakbrook Terrance, IL. 60181 Re: VASCO Data Security International, Inc. Form 10-K for the Fiscal Year Ended December 31, 2008 Filed March 13, 2009 Form 10-Q for the Quarterly Period Ended March 31, 2009 Filed May 8, 2009 File No. 0-24389 Dear Mr. Hunt: We have reviewed the above-referenced f ilings and have the following comments. If indicated, we think you shoul d revise your document in response to these comments. If you disagree, we will consider your explanation as to why our comment is inapplicable or a revision is unnecessary. Please be as detailed as necessary in your explanation. In some of our comments, we may ask you to provide us with supplemental information so we may better understand your disclosure. After re viewing this information, we may raise additional comments. Please understand that the purpose of our re view process is to assist you in your compliance with the applicable disclosure requirements and to enhance the overall disclosure in your filing. We look forward to working with you in these respects. We welcome any questions you may have about our comments or any other aspect of our review. Feel free to call us at the telephone numbers listed at the end of this letter. Form 10-K for the Fiscal Year Ended December 31, 2008 General 1. We note from disclosure on pages 16 and 32 that you conduct operations in the Middle East and Africa. Ira n and Syria, located in the Middle East and Sudan, located in A frica, are identified by the State Department as state sponsors of terrorism, and are subject to U.S. economic sanctions and export controls. We note T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 2 that your Form 10-K does not include disclosure regarding contacts with, Iran, Syria, and Sudan. Please describe to us th e nature and extent of your past, current, and anticipated contacts with the referenced countries, if any, whether through subsidiaries, resellers, retailers, distributors, or other direct or indirect arrangements. Your response should describe any pr oducts, equipment, components, technology, and services you have provided to those countries, and any agreements, commercial arrangements, or other c ontacts you have had with the governments of those countries or entities controlled by those governments. 2. It appears from various news articles and from intern et websites that Arab Bank, Abu Dhabi Commercial Bank and FVC, Inc. are or were your customers and that Arab Bank has operations in Syria and Sudan; Abu Dhabi Commercial Bank has operations in Iran, and FVC Inc. has operations in Iran and Syria. Please tell us whether these companies use your solutions, pr oducts or services in their operations in Iran, Sudan or Syria. Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations General, page 30 3. We note your disclosures on page 32 where you indicate that reve nues in fiscal 2008 were im pacted by an increase in the numb er of hardware DIGIPASS units sold, which was partially offset by a decline in the average price of such units. Tell us how you considered discussing in quantifie d terms the extent to which material changes in revenue were due to changes in volume versus changes in pricing. Refer to Item 303(a)(3)(iii) of Regulation S-K. 4. There are many instances where two or more sources of a m aterial change have been identified, but the dollar amounts for each sour ce that contributed to the change were not disclosed (e.g. revenue, gross prof it, sales and marke ting, general and administrative, etc.). For instance, you lis t several factors that contributed to the increase in gross profits in fiscal 200 8; however, you do not quantify what impact each factor had on your gross profit margin s. Similarly, you indicate that the increase in sales and marketing expense was due to an increase in average headcount, costs related to opening new offi ces, an increase in marketing programs and an increase in travel expenses, ho wever, you do not quantify the increase for each. Tell us what consideration you have given to quantifying each source that contributed to a material change pursuant to Section III. D of SEC Release 33-6835. T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 3 5. We note that your quarterly earnings releases list the num ber of new bank and enterprise security customers. Please tell us whether this is a key business metric considered by your management, and what consideration you ga ve to including a qualitative and quantitativ e discussion of the impact of new customers. Contractual Obligations, page 41 6. Tell us your consider ation to disclose the Com pany’s obligations for unrecognized tax benefits in your table of contractual obligations or in the footnotes thereto. We refer you to Item 303(A)(5) of Regulation S-K. Item 8. Financial Statements and Supplemental Data Consolidated Statement of Operations, page F-5 7. We note your disclosures on page 35 wher e you indicate that non-hardware product revenue has increased to approxim ately 25% of total revenue in 2008 and related maintenance revenue will continue to increase as a percentage of your total revenue. Please tell us how you considered presen ting separate line items for product and service revenues and the related cost of revenues pursuant to Ar ticle 5-03(b)(1) and (2) of Regulation S-X. Note 1 Summary of Significant Accounting Policies Revenue Recognition, page F-8 8. We note your disclosures on page F-9 where you indicate that the fair value of each elem ent in the multiple element arrangements is based on the price charged when sold separately, renewal rates and othe r methods. Please further explain your reference to “other methods” in establishi ng the fair value of each element included in your contracts. 9. We also note from your response to our pr ior comment 9 in your letter dated June 17, 2005 that pricing for the renewal of PCS is ba sed on an established percentage of the user license fee attributab le to the specific software as is applied “consistently to all PCS arrangements.” Please clarify whethe r your contracts include stated renewal rate or whether VSOE of PCS is based on se parate sales transactions. If the former is the case, then tell us how you determined such rates are substantive pursuant to paragraph 57 of SOP 97-2. In this regard, tell us the range of rates that you offer and what percentages of your customers ha ve actually renewed PCS at the stated renewal rates. If VSOE of PCS is based on separate sales, then please describe the process you use to evaluate the various factors that affect your VSOE including customer type, geographic region, etc. Furt her address the issue that if your VSOE T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 4 varies from customer to customer, how you can reasonably estimate fair value. We refer you to paragraphs 10 of SOP 97-2. 10. Your response to prior comment 9 also indi c ates that the fair value for tokens is based on standard price lists or based upon specific negotiated prices if quantities being sold are greater than t hose included in the price list. You further state that the fair value for software licenses are establ ished from standard pr ice lists. Please explain further your methodology for establ ishing VSOE of fair value for the Company’s token and software licenses included in multiple element arrangements. If the Company is relying sole ly on list prices for these pr oducts, then please explain further how you determined this is an appr opriate measure of VSOE of fair value pursuant to paragraph 16 of EITF 00 -21 and paragraph 10 of SOP 97-2, as applicable. Cash and Cash Equivalents, page F-9 11. We note that you consider investments with original m aturities of three months or less to be cash equivalents. Tell us how you considered providing disclosures pursuant to the requirements of paragra phs 32 to 35 of SFAS 157 related to your cash equivalent investments. In addition, pl ease tell us and in the future revise to disclose the composition of your cash and cas h equivalents and the amounts held in each type of instrument. Item 9A. Controls and Procedures Evaluation of Disclosure Cont rols and Procedures, page 45 12. You state that your disclosure controls and procedures we re effective as designed to ensure th at information relating to the co mpany and its consolidated subsidiaries would be accumulated and communicated to them, as appropriate, to allow timely “disclosures” regarding required disclo sures. In addition to containing a typographical error, your statement provides a more limited definition of disclosure controls and procedures than that provid ed in Rule 13a-15(e) under the Exchange Act. Moreover, your conclusion as to the effectiveness of your disclosure controls and procedures is given with respect to only part of the defi nition of disclosure controls and procedures. Please refer to prior comment 5 of our letter dated May 26, 2005 and your June 17, 2005 response i ndicating that you would provide conforming disclosure concerning your effectiveness conclusions. Please confirm, if true, that your officers conc luded as of the end of the period covered by the report, that your disclosure controls and proce dures were effective to ensure that information required to be disclosed by the Company in reports filed or submitted under the Exchange Act was recorded, pro cessed, summarized and reported within the time periods specified in the Securi ties and Exchange Commission’s rules, and that information required to be disclosed in the reports that y ou file or submit under T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 5 the Exchange Act is accumulated and co mmunicated to your management, including your chief executive officer and chief financial officer, to allow timely decisions regarding required disclosure. Please al so confirm that you will provide conforming disclosure in future filings. Note that this comment also applies to your quarterly report on Form 10-Q for the quarter ended March 31, 2009. 13. We note your statement that “a control system , no matter how well designed and implemented, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met.” Please confirm, if true, that your disclosure controls and proce dures are designed to provide reasonable assurance of achieving their objectives and that your principal executive officer and principal financial officer concluded that your disclosure contro ls and procedures were effective at that reasonable assurance level. Please conf irm that you will provide disclosure that conforms to the rule requirements. Pleas e note, alternatively, that you may remove the reference to the level of assurance of your disclosure controls and procedures in future filings. Please refer to Section II.F.4 of Management’s Reports on Internal Control Over Financial Reporting and Certif ication of Disclosure in Exchange Act Periodic Reports, SEC Release No. 33-8238, available on our website at http://www.sec.gov/rules/final/33-8238.htm . Changes in Internal Controls, page 45 14. We note your statement that there were no “significant” changes in the company’s internal con trol over financial reporti ng during the quarter ended December 31, 2008. We also note that in your June 17, 2005 response to comment 6 of our letter dated May 26, 2005, you stated: “In future fi lings, the Company will ensure that its disclosures in this regard conform with It em 308(c).” Item 308(c) of Regulation S- K requires you to disclose any change in your internal c ontrol over financial reporting identified in connection with th e evaluation required by paragraph (d) of Rule 13a-15 or Rule 15d-15 under the Exchange Act that occurred during your last fiscal quarter (the fourth fiscal quarter in the case of an annual report) that has materially affected, or is r easonably likely to materially affect, your internal control over financial reporting. In your suppleme ntal response, please advise us whether there was any change in your internal control over financial repor ting that occurred during the fourth quarter that has material ly affected, or is reasonably likely to materially affect, your intern al control over financial repor ting. In addition, please confirm that you will address this in future filings. T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 6 Item 11. Executive Compensation, page 49 (Inco rporated by Reference From Definitive Proxy Statement Filed April 30, 2009) Executive Compensation Compensation Discussion and Analysis, page 22 15. We note your disclosure on page 23 that the Compensation Comm ittee has the option to reduce the annual incentive aw ard by up to 10 percent if the individual executive’s performance did not meet his annual goals. In future filings, please clarify whether or not your Compensati on Committee exercised this option, as well as the extent to which it impacted each named executive officer’s awarded compensation for the prior fiscal year. 16. In charts on page 26 you have disclosed salary and bonus inform ation for Mr. Valcke in Euros. In future filings, consistent with your other tabular disclosure, please list all compensation in dollars, and use a footnote to disclose the amount in Euros, the exchange rate utilized, and th e date of the exchange rate utilized. Item 13. Certain Relationships and Related Tr ansactions, and Director Independence, page 49 (Incorporated by Reference From Definitive Proxy Statement Filed April 30, 2009) Transactions With Related Persons, page 42 17. We note your statement that because you have not engaged in related person transactions reportable pursuant to Item 404(a) of Regulation S-K, you have not adopted any formal policies or procedures for the review, approval or ratification of related person transactions. It does not appear that you may omit the disclosure required by Item 404(b) of Regulation S-K on this basis. In your response, please explain how you determined that you do not have any related person transactions reportable pursuant to Item 404(a), given your lack of formal re lated person policies and procedures. In addition, please tell us whether you have a ny plan to develop policies and procedures and, if so, whether such policies and procedures will be in writing. Please refer to paragraph (b) of Item 404 of Regulation S-K for further guidance and examples regarding material f eatures of such policies and procedures. Item 15. Exhibits and Financia l Statements Schedules, page 50 18. We note your disclosure on page 13 that you use a lim ited number of microprocessors, made by Samsung, for the various hardware products you produce, and that the microprocessors are the only components of your security authenticators that are not commodity items readily available on the open market. Please tell us whether you have an agreement with Samsung. If you have an agreement with T. Kendall Hunt VASCO Data Security International, Inc. June 30, 2009 Page 7 Samsung, please provide us with your analysis as to how you determined not to file the agreement as an exhibit pursuant to Item 601(b)(10)(ii )(B) of Regulation S-K. Exhibits 31.1 and 31.2 19. The certifications may not be changed in any respect from the language of Item 601(b)(31) of Regulation S-K, even if the change would appear to be inconsequential in nature . See Section II.B.4 of SEC Release No. 34-46427. We note that you have included the title of th e certifying individual when identifying the individual at the b