February 13, 2023
VIA EDGAR
Cara Lubit
Robert Klein
Division of Corporation Finance
Office of Finance
United States Securities and Exchange Commission
100 F Street, N.E.
Washington, D.C. 20549
Re: | Credit Suisse AG Form 20-F for the Fiscal Year Ended December 31, 2021 Response Dated November 18, 2022 File No. 001-33434 |
Dear Ms. Lubit and Mr. Klein:
Credit Suisse AG (the “Bank” or “Credit Suisse”) is writing in response to the letter from the staff (the “Staff”) of the United States Securities and Exchange Commission (the “Commission”) dated January 17, 2023, containing the Staff’s comments with respect to the Bank’s annual report on Form 20-F for the fiscal year ended December 31, 2021, filed with the Commission on March 10, 2022 (the “2021 Form 20-F”). As discussed between Ms. Lubit of the Staff and Sebastian Sperber of Cleary Gottlieb Steen & Hamilton LLP, our counsel, on January 23, 2023, the Bank very much appreciates the Staff’s accommodation to file its response via EDGAR on or before February 14, 2023, as opposed to submitting it by the originally requested deadline.
For ease of reference, the Bank has repeated the Staff’s comments in italicized text prior to its responses. Defined terms in our responses that are not defined below are defined in the 2021 Form 20-F. Please note that in the version of this letter filed via EDGAR confidential information has been omitted and delivered separately to the Staff and the redactions are denoted in the EDGAR-filed version by bracketed asterisks (“[***]”).
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 2
Form 20-F for the Fiscal Year Ended December 31, 2021
Notes to the Consolidated Financial Statements
Note 1 - Summary of Significant Accounting Policies
Revisions of Prior Period Financial Statements, page 466
1. | We note your response to prior comments 2 and 3. We continue to have questions as to the actual control(s) that were deficient. For each identified control deficiency, please address the following: |
· | Identify the deficient control(s), provide a description of how each control was designed to address the related risk of material misstatement, and explain whether the deficiency related to the design or operating effectiveness of the control. |
· | Provide management’s root cause analysis. In your response, tell us how the root cause(s), including instances where the root cause is related to the knowledge assessment and technical accounting expertise of the control owner, impact your conclusions around entity level controls. |
· | Describe any remediation efforts, including the nature and timing of remediation, and how the remedial actions address the related root cause(s). |
Response to Comment 1
We acknowledge the Staff’s comment requesting clarification as to the actual controls that were deficient.
Presentation of non-cash equity statement movements deficiency
As noted in our response to prior comment 2 on November 18, 2022, management self-identified in 2021 a control deficiency relating to the presentation and disclosure of a limited number of non-core, unique and/or immaterial equity statement movement line items (e.g., share-based compensation, cash flow hedges) within the appropriate section / line item in the consolidated statement of cash flows. This resulted in prior period corrections, as outlined in Exhibit A in our prior response on November 18, 2022, to reclassify the non-cash portion of these items from the ‘Other, net’ line in the financing section to the operating section of the consolidated statement of cash flows. In our prior response on November 18, 2022, we referred to this control deficiency as the “Mapping rules deficiency” but we will refer to this deficiency as the “Presentation of non-cash equity statement movements deficiency” hereafter.
· | What is the deficient control? |
There was not a control in our inventory that was explicitly designed to designate the non-cash elements of a limited number of equity statement movements relating to certain non-core, unique and/or immaterial line items (e.g., share-based compensation, cash flow hedges) for presentation and disclosure within the operating section of the consolidated statement of cash flows.
The control that should have been in place to mitigate this specific presentation and disclosure risk was a quarterly designation of the non-cash transactions relating to these limited, non-core, and/or unique equity statement movement line items for intra-statement classification within the consolidated statement of cash flows.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 3
· | Describe how the control was designed to address the related risk of material misstatement. |
Not applicable – see above.
· | Is the deficiency related to the design or operating effectiveness of the control? |
The deficiency related to design effectiveness as there was not a control in our inventory that was explicitly designed to mitigate the specific presentation and disclosure risks relating to the non-cash elements of these limited, non-core, and/or unique line items.
· | Provide management’s root cause analysis. |
The requirement for a control to mitigate this specific presentation and disclosure risk for these items was not previously identified, as these items relate to non-core activities of the Bank, which are limited in number and/or unique in nature, and were immaterial, individually and in the aggregate, to the cash flow statement. As a risk of material misstatement was not identified, a distinct control was not designed and implemented.
Management concluded that this was not indicative of a pervasive issue, given the unique and limited nature of the items and the factors noted above. Certain reconciling items in the cash flow statement, specifically those impacted by this issue, did not lend themselves to the establishment of an objective expectation. However, the total investing and financing captions within the consolidated statement of cash flows may lend themselves to more predictability based upon current period lending and financing activity, as compared to certain individual line items within the consolidated statement of cash flows.
The issue does not extend to other principal financial statement elements due to controls such as the following.
o | Balance sheet and off-balance sheet accounts are subject to general ledger account ownership, reconciliations, substantiation, and monthly sign-off by named employees with direct ownership and familiarity with each specific account. |
o | Income statement accounts are subject to a variety of controls across the first and second lines of defense, and given the nature of profit and loss, control performers can empirically establish an expectation for analytical or other detective plausibility checks items (e.g., revenues driven by volumes, etc.). |
· | Is the root cause related to the knowledge assessment and technical accounting expertise of the control owner, and what is the impact on our conclusions around entity level controls? |
The root cause does not have to do with the knowledge or competency of a control owner, but rather a missing designation and step for review of these items within a wider process. The need for the control was not previously identified due to the nature of these items (e.g., non-core business activities, unique in nature, limited in number, and/or quantitatively immaterial).
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 4
· | Describe any remediation efforts, including the nature and timing of remediation, and how the remedial actions address the related root cause(s). |
Date/Period | Event/Activity |
Q3 2021 |
Management identified the control deficiency.
Management enhanced the process design to explicitly include a quarterly review of the designation and presentation of share-based compensation as a stand-alone financial statement line item within the consolidated statement of cash flows, and the designation and presentation of the non-cash elements relating to the other items (e.g., cash flow hedges). This quarterly control activity operated for the first time in support of the filing of our Q3 2021 Form 6-K. This addressed the root cause as it ensures that there is sufficient quarterly consideration of the non-cash designation and presentation of these unique and/or immaterial items. |
Q4 2021 | The quarterly control activity implemented as part of the remediation operated for the second time in support of the filing of our 2021 Form 20-F. |
Year-end 2021 (prior to filing of the 2021 Form 20-F) |
Management concluded that the quarterly control was designed and operating effectively as of December 31, 2021.
The control deficiency was remediated as of December 31, 2021. |
Nonfunctional currency gains and losses deficiency
As noted in our response to prior comment 2 on November 18, 2022, management self-identified in 2021 a control deficiency relating to non-functional currency gains and losses (“Nonfunctional currency gains and losses deficiency”), which relates to the exclusion of certain instruments from the computation and reporting of the cash flow effects of gains and losses on remeasurements (transactional currency to functional currency) within the consolidated statement of cash flows.
· | What is the deficient control? |
There was not a control in our inventory that was explicitly designed to mitigate the specific presentation and disclosure risk relating to the relevant instruments excluded from our computation and reporting of the cash flow effects of gains and losses on remeasurements within the consolidated statement of cash flows.
The control that should have been in place was the periodic assessment of the quantified impact of the instruments that are excluded from the computation of foreign currency exposures for the relevant monetary assets and liabilities within legal entities that could significantly impact the total net cash provided by/(used in) operating activities, investing activities, and/or financing activities; with consideration of the coverage of instruments, and extension of coverage if deemed to be material.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 5
· | Describe how the control was designed to address the related risk of material misstatement. |
Not applicable – see above.
· | Is the deficiency related to the design or operating effectiveness of the control? |
The deficiency relates to design effectiveness as there was not a control in our inventory that was explicitly designed to mitigate this specific presentation and disclosure risk relating to the relevant instruments excluded from our computation and reporting of the cash flow effects of gains and losses on remeasurements within the consolidated statement of cash flows.
· | Provide management’s root cause analysis. |
The computation only included the relevant instruments that are considered material in relation to the cash flow effects of gains and losses resulting from the remeasurement of foreign currency-denominated monetary assets and liabilities. There was an embedded assumption about the materiality of the instruments that were excluded within our computation of the cash flow effects of gains and losses resulting from the remeasurement of foreign currency-denominated monetary assets and liabilities. There was no Bank level assessment and challenge of the assumptions regarding the materiality of the excluded instruments.
· | Is the root cause related to the knowledge assessment and technical accounting expertise of the control owner, and what is the impact on our conclusions around entity level controls? |
The root cause does not have to do with the knowledge or competency of a process or control owner, but rather the consideration of creating a distinct control activity to address this specific presentation and disclosure risk relating to the relevant instruments excluded from the computation of the cash flow effects of gains and losses resulting from the remeasurement of foreign currency-denominated monetary assets and liabilities.
· | Describe any remediation efforts, including the nature and timing of remediation, and how the remedial actions address the related root cause(s). |
Date/Period | Event/Activity |
Year-end 2021 (prior to filing of the 2021 Form 20-F) |
· Management implemented a process and operated a control activity, which was not subject to independent operating effectiveness testing, as of December 31, 2021, related to the inclusion of additional instruments (Loans and Customer deposits) in the FX remeasurement (Nonfunctional currency gains and losses) for cash flow statement purposes. |
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 6
· Management operated a control activity, which was not subject to independent operating effectiveness testing, as of December 31, 2021, related to the monitoring of the financial impact of excluded instruments from the FX remeasurement (Nonfunctional currency gains and losses) for cash flow statement purposes. Management did not elect to include additional instruments as the impact was not material. | |
2022 |
· Management enhanced the design of existing quarterly controls, which are owned by the respective legal entity controllers, to explicitly cover Net loans and Customer deposits in addition to Long-term debt. · Management formalized the control, which is subject to independent operating effectiveness testing, to periodically assess and monitor the materiality and quantified impact of instruments excluded in the computation of foreign currency exposures for the relevant monetary assets and liabilities within legal entities that could significantly impact the total net cash provided by/(used in) operating activities, investing activities, and/or financing activities. This control includes a consideration of the coverage of instruments and extension of coverage if deemed to be material. This addressed the root cause as it ensures that the quantified impact of the instruments excluded in the computation is explicitly and periodically considered in a formal control. |
2. | We note your response to prior comment 1 states that you perform an accounting Quality Assurance Review that focuses on a specific accounting topic, documenting and reviewing the way such topic is addressed across relevant entities and systems within the Group1 to ensure appropriate treatment. Your response further explained that the consolidated statement of cash flows was included in this review and that this management review was compensating in nature for the cash flow mapping deficiencies identified. For each control deficiency identified, please explain how you determined that management’s compensating controls compensate for the root cause(s) of the deficient controls. Specifically, for each compensating control, please explain and provide the following: |
· | The objective of the review control. For example, explain whether the control looks at how transactions should be treated and whether the treatment was properly implemented. |
· | The level of aggregation at which the control is performed. |
· | The frequency of the control. |
1 We note that the Staff references Credit Suisse Group AG here, while this letter is addressed to Credit Suisse AG. We have drafted our response to this comment 2 with reference to Credit Suisse AG. For a response that references Credit Suisse Group AG, please see our response to comment 2 of the Staff's letter addressed to Credit Suisse Group AG dated January 17, 2023, which we submitted concurrently with this response and which is substantively identical to our response to this comment 2, except for the entity referenced.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 7
· | The correlation of the control’s design to each of the risks of material misstatement related to these errors. |
· | The level of predictability of management’s expectations in their review. |
· | The criteria for investigating deviations or differences from expectations and how those criteria correlate to management’s materiality evaluation. As part of this response, explain whether the control identified any outliers in the operation of the control. |
· | Quantification of the level of precision and magnitude of the potential error that these compensating controls are designed to detect. |
Response to Comment 2
We acknowledge the Staff’s comment regarding compensating controls.
There are a variety of controls in place over the consolidated statement of cash flows. [***]
We acknowledge the Staff’s comment regarding the Bank’s Quality Assurance Review (“QAR”) function and its involvement in the identification and remediation of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency, and we wish to clarify the response provided to prior comment 1 on November 18, 2022.
Management established the QAR function as an element of the monitoring component of the Bank’s internal control over financial reporting (“ICFR”) framework. Throughout each year, the QAR function reviews and assesses processes and accounting treatments, on a sample basis, across the Bank’s consolidated financial statements. We have not identified such QAR reviews as a separate direct and precise control to address any individual financial statement risk. Further, it was not a QAR review that identified the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency. The reference to the QAR function in our response to prior comment 1 on November 18, 2022, was solely intended to provide this function as an illustrative example of the various elements of management’s continuous monitoring activities that form part of the Bank’s overall ICFR framework.
In addition to the QAR function, in our response to prior comment 1 on November 18, 2022, we referenced a review, which identified the Presentation of non-cash equity statement movements deficiency and the Nonfunctional gains and losses deficiency. In that prior response, we provided a list of qualitative factors that were considered when evaluating the severity of the identified control deficiencies and indicated that the review was “compensating in nature”. We did not intend to suggest that this review was designed to operate as a compensating control for the root cause associated with either the Presentation of non-cash equity statement movements deficiency or the Nonfunctional currency gains and losses deficiency; rather, the review represented a risk assessment activity. The objective of this risk assessment activity was to identify the risks of material misstatement within specific financial reporting processes, and where existing controls were not sufficiently direct and precise to address such risk, to perform remediation of the control or implementation of a new control activity.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 8
We believe it is helpful to provide the Staff with the timeline of events to illustrate that the correction of the cash flow statement misstatements and remediation of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency as of December 31, 2021, was the culmination of activities which commenced in August 2020. Please refer to Exhibit B.
3. | We note your response to prior comment 2 discusses how you evaluated the severity of each of the identified control deficiencies. It appears your analysis primarily focused on the actual size of the errors identified rather than the potential magnitude. For each control deficiency identified, please respond to the following: |
· | Describe the factors that affected the magnitude of the misstatement that might result from the deficiency, including (i) the total monetary amount of transactions exposed to the deficiency and (ii) the volume of activity in the account balance or class of transactions exposed to the deficiency in the current period or that is expected in a future period. |
· | Quantify the magnitude of the potential misstatement for each of the identified control deficiencies. |
· | Explain whether the qualitative factors also included considerations of other impacts, such as regulatory requirements and other ratios. |
Response to Comment 3
We acknowledge the Staff’s comment regarding how we evaluated the severity of each of the identified control deficiencies.
When we assess a control deficiency, we consider both quantitative and qualitative factors. This includes consideration of the nature of the deficiency, the deficient control(s), the impacted financial statement line item(s) and footnote disclosure(s), the root cause, the precision of compensating controls (if any), the likelihood of potential misstatement, the magnitude of potential misstatement (“the Could”), the actual error (if any), and the status of planned remediation activities. In addition, and as further outlined in our response to comment 4 in this letter, we perform an aggregation analysis of control matters quarterly and annually – this considers a variety of dimensions: financial statement line item, reporting theme, root cause, internal control objective (completeness, accuracy, validity, restricted access, timeliness), and criteria issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) (component and principle).
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 9
[***]
When assessing the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency, we consider what is likely to be most important to a reasonable investor with respect to the consolidated statement of cash flows. In that, we note that a reasonable investor would likely consider the overall total trend and direction of the three prominent captions within the statement to be of most importance: Net cash provided by/(used in) operating activities, Net cash provided by/(used in) investing activities, and Net cash provided by/(used in) financing activities. We consider that Generally Accepted Accounting Principles in the United States of America (“US GAAP”) require that we report on these subtotal captions, which we believe signifies their importance to users of our financial reporting. We also believe that a reasonable investor would consider the nature of the individual financial statement line items in the context of what the Bank is invested in and the nature of our banking business, which means that movements in loans and customer deposits are correlated and connected to the operation of the business overall.
Factors that affected the magnitude of the misstatement that might result from the deficiency and quantified magnitude of the potential misstatement
We acknowledge the Staff’s comment to describe the factors that affected the magnitude of the misstatement that might result from the deficiency, including (i) the total monetary amount of transactions exposed to the deficiency and (ii) the volume of activity in the account balance or class of transactions exposed to the deficiency in the current period or that is expected in a future period. We also acknowledge the Staff’s comment to quantify the magnitude of the potential misstatement for each of the identified control deficiencies. [***]
In determining the magnitude of the potential misstatement that might result from each of these deficiencies, we consider a variety of factors, including the nature of the deficiency, the design of the underlying process and controls, and the total monetary amount and volume in the account balance or financial statement element exposed to the deficiency. The cash flow statement elements impacted by each of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency are subject to volatility year over year. Therefore, to assess the volume of activity exposed to the deficiencies, in 2021 and that which may be expected in future periods, we have performed an analysis of the potential misstatement each quarter over a historical 4-year period (2018 to 2021). We considered this period, which extends beyond the periods presented in any current annual or interim filings, because we acknowledge that each control deficiency existed for several years, and we evaluated whether our control framework did not detect a material unmitigated risk over an extended period. We chose to start with 2018 because that was the year in which a restructuring, which commenced in 2015 under our former Chairman of the Board of Directors and former Group Chief Executive Officer, was completed; hence, the comparability of years prior to 2018 is decreased. We believe the 4-year period from 2018 to 2021 provides a range of activity that could be reasonably expected in any given period. This section of our response sets out our approach to determine the monetary amount and volume exposed to each of the identified deficiencies.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 10
Presentation of non-cash equity statement movements deficiency
[***]
In combination with the factors that we outlined in our prior response to comment 2 on November 18, 2022, we do not consider that there is a substantial likelihood that the potential misstatements resulting from the Presentation of non-cash equity statement movements deficiency would have been viewed by a reasonable investor as having significantly altered the ‘total mix’ of information made available.
[***]
Nonfunctional currency gains and losses deficiency
[***]
In combination with the factors that we outlined in our prior response to comment 2 on November 18, 2022, we do not consider that there is a substantial likelihood that the potential misstatements resulting from the Nonfunctional currency gains and losses deficiency would have been viewed by a reasonable investor as having significantly altered the ‘total mix’ of information made available.
[***]
Considerations of other impacts, such as regulatory requirements and other ratios
We acknowledge the Staff’s comment to explain whether the qualitative factors also included considerations of other impacts, such as regulatory requirements and other ratios.
As outlined in our prior response to comment 2 on November 18, 2022, we consider quantitative and qualitative factors when assessing the severity of this control deficiency. From a qualitative perspective, we consider whether there is substantial likelihood that the potential misstatements arising from the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency would have been viewed by a reasonable investor as material or as having significantly altered the ‘total mix’ of information made available.
Our consideration starts with what is likely to be most important to a reasonable investor within the consolidated statement of cash flows. We believe that a reasonable investor would likely consider the overall total trend and direction of and the relationship between the three prominent sections within the statement to be of most importance: Net cash provided by/(used in) operating activities, Net cash provided by/(used in) investing activities, and Net cash provided by/(used in) financing activities.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 11
We further consider, as a part of the ‘total mix’ of information available, that there was no impact from the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency to the other consolidated financial statements or notes to the consolidated financial statements. In addition, there was no impact to the other information available, such as the liquidity metrics and disclosures in the Liquidity and funding management section of our Form 20-F (e.g., liquidity coverage ratio, net stable funding ratio) or the Capital management section of our Form 20-F (e.g., common equity tier 1 ratio).
4. | We note your response to prior comment 2, which states that, as it related to the mapping deficiency, the likelihood of the potential misstatement was remote and the magnitude of the potential misstatement was not material. In addition, the response states that, for the nonfunctional currency gains and loss deficiency, the likelihood of potential misstatement was reasonably possible, but the magnitude of the potential misstatement was not material. Please explain in more detail how you performed the severity analysis for each of the control deficiencies related to the errors. As part of your response, please address the following: |
· | Explain in more detail how you supported the conclusions outlined above related to the likelihood of potential misstatements and the potential magnitude for each deficiency. |
· | Since the control deficiencies remained un-remediated for multiple years, tell us how this was considered in the evaluation of the severity of the control deficiencies. |
· | Given that a restatement of previously issued financial statements for a correction of an error is an indicator of a material weakness, explain how you considered the restatement of previously issued financial statements to reflect the correction of these errors, as described in Note 1 of your 2021 Form 20-F, in your evaluation of whether the control deficiencies represented a material weakness. |
· | Provide management’s aggregation analysis of all control deficiencies identified for the period. |
Response to Comment 4
Likelihood of the potential misstatement and the magnitude of the potential misstatement
We acknowledge the Staff’s comments relating to the likelihood of the potential misstatement and the magnitude of the potential misstatement.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 12
Presentation of non-cash equity statement movements deficiency
The likelihood of a potential misstatement was reasonably possible as of September 30, 2021, as the control deficiency was open as of September 30, 2021. The likelihood of a potential material misstatement was remote as of December 31, 2021, as the control deficiency was remediated as of December 31, 2021.
Nonfunctional currency gains and losses deficiency
The likelihood of a potential misstatement was reasonably possible as not all instruments were, or are, included in the FX computation. At the time in 2021 that the deficiency was identified, raised, and subject to severity assessment, we had already determined to extend the coverage of instruments from Long-term debt to also include Net loans and Customer deposits, and had assessed the potential impact of the instruments that were excluded in the computation.
The Could was not material. A reasonable investor would likely consider the overall total trend and direction of the three prominent sections within the statement to be of most importance: Net cash provided by/(used in) operating activities, Net cash provided by/(used in) investing activities, and Net cash provided by/(used in) financing activities. Further qualitative considerations include the likely impact to a reasonable investor in respect of the ‘total mix’ of information available. In addition to the qualitative factors noted in our response to prior comment 2 on November 18, 2022, and further outlined in our response to comment 3 in this letter, we believe that there is not a substantial likelihood that the potential misstatement resulting from this control deficiency would have been viewed by a reasonable investor as material or as having significantly altered the ‘total mix’ of information made available.
Consideration that the control deficiencies remained un-remediated for multiple years
We acknowledge the Staff’s comment that the control deficiencies remained unidentified and un-remediated for multiple years.
As noted in our response to comment 3 in this letter, we revisited the presentation and disclosure risk relating to the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency to challenge and validate the outcome of our original conclusion. We assessed the Could for each quarter over a 4-year period starting from Q1 2018. We considered this period, which extends beyond the periods presented in any current annual or interim filings, because we acknowledge that each control deficiency existed for several years, and we evaluated whether our control framework did not detect a material unmitigated risk over an extended period. In addition, we did evaluate this deficiency in the context of our entity level controls, as illustrated in Exhibit A.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 13
Consideration that a restatement of previously issued financial statements for a correction of an error is an indicator of a material weakness
We acknowledge the Staff’s comment relating to our evaluation of whether the control deficiencies represented a material weakness considering that a restatement of previously issued financial statements for a correction of an error is an indicator of a material weakness.
Presentation of non-cash equity statement movements deficiency
The decision by management to correct prior periods for this matter was not driven by the materiality of the corrections from the perspective of a reasonable investor [***].
Nonfunctional gains and losses deficiency
The decision by management to correct prior periods for this matter was not driven by the materiality of the corrections from the perspective of a reasonable investor. [***]
Management’s aggregation analysis as of December 31, 2021
We acknowledge the Staff’s comment to provide management’s aggregation analysis.
Management’s aggregation analysis process
Quarterly and annually, management performs an aggregation analysis of control matters. We aggregate by a variety of quantitative (potential magnitude of misstatement) and qualitative dimensions, including financial statement line item, reporting theme, root cause, internal control objective (completeness, accuracy, validity, restricted access, timeliness), and COSO component and principle.
· | The quarterly and annual aggregation analysis across all these quantitative and qualitative dimensions is reported to a senior management SOX Steering Committee (“STC”). | |
· | The annual aggregation analysis across all these quantitative and qualitative dimensions is reported to and discussed with the Bank Chief Executive Officer (“CEO”) and Bank Chief Financial Officer (“CFO”) in advance of the filing of the Form 20-F. | |
· | The results of the aggregation analysis are reported to the BoD Audit Committee, either as required or as deemed appropriate by management to provide transparency on the control environment. |
When assessing across and within these various quantitative and qualitative dimensions, we consider a variety of elements. This includes consideration of the nature of the issues, the Could, and whether there are any unusual or anomalous concentrations of control matters in a division, function, legal entity, geography, process, or control owner. We also consider whether the control matters are reflective of pervasive matters across the Bank that could result in a material misstatement to our financial reporting.
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 14
Management’s aggregation analysis
[***]
Management concluded, based on information available at the time, that there was not a significant aggregation of or commonality across control matters that could impact the classification of the Nonfunctional currency gains and losses deficiency, individually or in aggregate, as of December 31, 2021.
We acknowledge that the severity assessment and classification of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency was a professional judgment. In arriving at such judgments, we consider a variety of quantitative and qualitative factors, consult among a variety of internal stakeholders, including a senior management SOX STC, and discuss with our independent external auditors. Given the importance of the consolidated statement of cash flows as a primary financial statement and for transparency on the control environment, [***].
[***]
Management’s evaluation and assessment of the Bank’s ICFR, including the aggregation analysis, uses the criteria established in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in “Internal Control – Integrated Framework”, which incorporates the five COSO components of Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. Management concluded that each of the five COSO components were present and functioning. Please refer to Exhibit A for further detail regarding our assessment of the five COSO components.
* * * * *
Ms. Cara Lubit and Mr. Robert Klein
Securities and Exchange Commission
February 13, 2023
Page 15
The Bank acknowledges that it is responsible for the adequacy and accuracy of the disclosure in its filings with the Commission, that Staff comments or changes to disclosure in response to Staff comments do not foreclose the Commission from taking any action with respect to the filings, and that it may not assert Staff comments as a defense in any proceeding initiated by the Commission or any person under the federal securities laws of the United States.
The Bank hopes that its responses adequately address each of the Staff’s comments. If the Staff has any questions concerning this letter or requires further information, please do not hesitate to contact Robert Arbuthnott, Head of Group Finance and Chief Accounting Officer, in Zurich at 011-41-44-332-6261, Todd Runyan, Group Accountant, in Zurich at 011-41-44-334-8063, Christopher Harris, Head of External Reporting, in Zurich at 011-41-44-333-8395, or me in Zurich at 011-41-44-333-1780.
Very truly yours, | |
CREDIT SUISSE AG | |
/s/ Dixit Joshi | |
Dixit Joshi | |
Chief Financial Officer |
cc: | Mirko Bianchi | ||
Chairman of the Audit Committee Credit Suisse AG | |||
Sebastian R. Sperber, Esq. | |||
Cleary Gottlieb Steen & Hamilton LLP |
EXHIBIT A
Consideration of the criteria issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in “Internal Control – Integrated Framework”
The control environment, as established by the Bank’s senior management and BoD, influences the overall control focus of management, and serves as the foundation for the Bank’s ICFR framework. That framework includes various information and communication features that are designed to ensure that employees understand the importance of internal control and have clear guidance regarding the evaluation and testing of control effectiveness, and information systems incorporate controls that provide assurance that data processing produces reliable information. Specifically, formal control activities are documented in the form of policies, procedures and controls, and a signoff/certification by process and control owners is required under the ICFR framework. Policies and procedures also include information on implementing controls as part of the overall business process and communication by the Bank’s senior management of the importance of a strong internal control environment. Monitoring of control activities is achieved through self-assessment, independent design and operating effectiveness testing of controls, and Internal Audit. Communication of testing results is made to the Bank’s senior management and at least quarterly updates are provided to the BoD AC (e.g., scoping, results of testing, analysis of deficiencies, status of remediation of deficiencies, etc.). Risk assessment within the ICFR framework occurs via identification and documentation of risks and controls by business owners, a top down, risk-based approach to scoping is applied as the basis for the testing program and evaluation of identified deficiencies in line with the Bank’s deficiency risk rating process, which is based on a standardized set of criteria.
Our assessment concluded that each of the five COSO components were present and functioning.
Control Environment
The Bank has a culture of identifying, reporting, and ensuring action on a broad range of control matters – including controls that are deficient in their design or operation, potentially emerging resourcing constraints, controls that are operating, but could be enhanced through automation, etc. The Bank has established lines of reporting directly from the Head of the CFO Risk and Control Office to the BoD AC, and to the broader organization, through a senior management SOX STC. There is ongoing and active discussion with the BoD AC on the control environment. Management of the Bank has the endorsement of those charged with governance, as well as senior management to ensure appropriate remedial actions are taken when control deficiencies are identified. As such, we continue to believe that our control environment was established to foster effective ICFR as of December 31, 2021.
Risk Assessment
The Bank represents a large, global, diversified financial institution with an associated level of complexity. The CFO function has developed a risk and control framework inclusive of the risks related to ICFR, commensurate with the size and complexity of the organization. This also feeds into the Bank’s broader non-financial risk and control framework, which is established and communicated through policy statements and enforced through second line of defense and third line of defense monitoring. The risk identification and assessment are informed by risk incidents (actual or near financial losses or reporting errors), internal and external audit findings, control owners’ self-assessments, and the monitoring by the CFO Risk & Control Office. All such findings are logged as control matters, evaluated for root cause and potential impact, and have an action plan and committed response/delivery date associated with them. This is then subject to various levels of reporting across management, as well as to the BoD AC. In this way, management can identify residual risks, which require focused attention. This culminates with the reporting to the BoD AC, which has been summarized in the response to comment 2 in this letter.
Any system of ICFR can only be designed to provide reasonable, rather than absolute assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes, and this extends to the risk assessment component. It is not possible to provide absolute assurance that all risks have been identified and fully mitigated; however, the Bank does follow its established policies and framework to obtain reasonable assurance that risks of material misstatement to the consolidated financial statements have been identified and mitigated. In the context of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency discussed in this response, management had identified and designed effective controls to respond to the risk of material misstatement of key cash flow statement captions, i.e., operating, investing, and financing cash flows; and through its continuous monitoring and control enhancement processes, identified and sought to remediate the matters discussed in this response. As such, we continue to believe that our risk assessment framework was established to foster effective internal control over financial reporting as of December 31, 2021.
Control Activities
The Bank represents a large, global, diversified financial institution with an associated level of complexity. The Bank has identified [***] control activities that are owned across the divisions, functions, and lines of defense. It is important to note that management applies a conservative approach to documenting control matters, so that we have a comprehensive overview of the ICFR environment, the associated control initiatives and remediations underway across the Bank, and to drive and enhance the end-to-end balance between divisional and functional controls, preventative and detective controls, and automated and manual controls.
Quarterly and annually, management performs an aggregation analysis of control matters. We aggregate by a variety of quantitative (potential magnitude of misstatement) and qualitative dimensions, including financial statement line item, reporting theme, root cause, internal control objective (completeness, accuracy, validity, restricted access, timeliness), and COSO component and principle. This aggregation analysis is reported to a senior management SOX STC on a quarterly and annual basis, to the CEO and CFO annually prior to the filing of the annual Form 20-F, and the results are presented to the BoD AC, as required and to the extent deemed appropriate.
As such, we continue to believe that our control activities were selected and established to foster effective internal control over financial reporting as of December 31, 2021.
Information and Communication
There are two considerations as it relates to this COSO component.
First, management has concluded that the use of information technology within the organization is conducive to obtaining, generating and/or using relevant, quality information to support the functioning of internal control.
The second consideration relates to the communication of objectives and responsibilities for internal control, necessary to support the functioning of internal control. The Bank has a formal and robust SOX program, under the governance of the BoD AC, and delivered by the CFO Risk and Control Office. Responsibility and accountability are communicated through a comprehensive set of policies and procedures related to the firm-wide and CFO-specific risk and control frameworks. Further, the Bank employs a governance risk and compliance (“GRC”) tool, which has been built and designed to satisfy management’s requirements with respect to maintaining an inventory of controls and control matters, performing design, and operating effectiveness testing, and managing and documenting the internal process and control attestations. This GRC tool includes process and control documentation sufficient for control owners to execute on their responsibility, significant information regarding the monitoring of individual control activities, and an embedded tracking tool by which control matters are linked to controls, processes, and risks, so that they can be monitored, risk assessed, and reported throughout the organization.
Based on our evaluation of these two considerations, we continue to believe that information and communication within the Bank was maintained to foster effective ICFR as of December 31, 2021.
Monitoring
Ongoing monitoring activities are built into the Bank’s overall risk and control framework and include information obtained from various sources, including line and functional personnel and senior management, and may include communications from external parties (e.g., regulators, legal counsel, independent auditors). Additionally, separate independent evaluations performed by the Bank’s Internal Audit organization and the CFO Risk & Control Office validate the ongoing functioning and effectiveness of internal controls. Information from these various sources is used by management to continually update and reassess risk and to continually implement enhanced internal controls and monitoring activities.
As discussed in our response to comment 2 in this letter, the identification of the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency was the result of the consideration of information gathered through our ongoing monitoring activities. In August 2020, as part of the periodic reviews that we perform over our control environment, management commenced the formal review program with the plan to perform a risk assessment review of certain identified cash flow statement and footnote disclosure elements. The status of this review program was periodically reported to senior management and the BoD AC. As this program progressed, we were able to report to the BoD AC in further detail regarding the precise issues identified. This program culminated with the correction of prior period errors included in our 2021 Form 20-F, as well as the remediation of related control deficiencies in connection with our 2021 financial reporting process, and further refinement thereafter. Although, as noted, it is not possible to design an internal control framework that provides absolute assurance, we do believe that the process by which we identified, investigated, and remediated the Presentation of non-cash equity statement movements deficiency and identified, investigated, and are remediating the Nonfunctional currency gains and losses deficiency provides evidence that the Bank’s ongoing monitoring does foster effective internal control over financial reporting.
EXHIBIT B
Timeline
As illustrated in the timeline below, and as outlined in our response to prior comment 1 on November 18, 2022, as part of the periodic reviews that we perform over our control environment, management commenced a formal program in August 2020 to perform a detailed risk assessment review, using a risk-based approach, of footnote disclosure table extracts that were dependent on manual processes and/or on the receipt of non-balance sheet or income statement data elements, and also on the consolidated statement of cash flows, as the compilation of this requires recategorization of certain income statement line items, and the underlying processes are not fully automated. As a result of this formal program, management identified two separate control deficiencies relating to the consolidated statement of cash flows: the Presentation of non-cash equity statement movements deficiency and the Nonfunctional currency gains and losses deficiency. [***]
[***]