Internet Security Systems, Inc.
6303 Barfield Road
Atlanta, Georgia 30328
June 22, 2006
VIA EDGAR
United States Securities & Exchange Commission
Room 4561
Washington, D.C. 20549
Attn.: David Edgar
Re Internet Security Systems, Inc.
Form 10-K for Fiscal Year Ended December 31, 2005
Filed March 6, 2006
Form 8-K Filed April 25, 2006
File No. 000-23655
Dear Mr. Edgar:
On behalf of Internet Security Systems, Inc. (the “Company”), this letter responds to the comments of the Staff of the Commission to the above-referenced filings, as set forth in the letter from Mr. Brad Skinner, Accounting Branch Chief, dated June 5, 2006. Each of the Company’s responses is set forth immediately below the text of the Staff comment.
Form 10-K for Fiscal Year Ended December 31, 2005
Item 9A. Controls and Procedures
Disclosure Controls and Procedures, page 35
1. Staff Comment:
We note that your disclosure regarding the design of your disclosure controls and procedures is significantly more limited than that required by Rule 13a-15(e) of the Exchange Act. The rule requires, among other matters, that the disclosure controls and procedures be designed “to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Act is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms” and to ensure that “information required to be disclosed by an issuer is accumulated and ‘communicated to the issuer’s management as appropriate to allow timely decisions regarding required disclosure.” Please confirm, if true, that your disclosure controls and procedures for the relevant periods met all of the requirements of this rule and that you will conform your disclosure in future filings.
Company Response:
We confirm our disclosure controls and procedures for the relevant periods met all of the requirements of Rule 13a-15(e) of the Exchange Act, and we will conform our disclosure in future filings. Our proposed disclosure is as follows:
ISS maintains disclosure controls and procedures that are designed to ensure that information required to be disclosed in ISS’ Securities Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms, and that such information is accumulated and communicated to ISS’ management, including the Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls are met, and no evaluation of controls can provide absolute assurance that the system of controls has operated effectively in all cases. Our disclosure controls and procedures however are designed to provide reasonable assurance that the objectives of disclosure controls and procedures are met.
Our Chief Executive Officer and Chief Financial Officer have evaluated the effectiveness of ISS’ disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act) as of the end of the period covered by this report. Based on such evaluation, such officers have concluded that, as of the end of the period covered by this report, ISS’ disclosure controls and procedures were effective.
Notes to Consolidated Financial Statements
Note 1. Significant Accounting Policies
Revenue Recognition, page 45
2. Staff Comment:
We note your disclosure on page 11 that governmental customers may modify or cancel contracts which could have a negative impact on the Company. Describe these customer rights, including any fiscal funding clauses, in more detail and tell us how these rights affect your revenue recognition. In addition, explain to us how your current disclosures specifically address these rights.
Company Response:
In our risk factors on page 11 we identified a risk associated with public sector companies related to the modification or cancellation of contracts. This risk factor is associated with our forward looking statements and not with our revenue recognition.
2
The contractual rights of certain public sector customers to cancel a contract do not impact our revenue recognition as (i) these cancellation clauses do not apply to orders which have been delivered; and (ii) we do not recognize revenue until the product and/or service has been delivered (assuming all other criteria for revenue recognition have been met). In other words, the cancellation clauses do not apply to orders for which we have recognized revenue.
3. Staff Comment:
We note your disclosure that during the second quarter of 2005, you changed your Proventia pricing model to bundle content blades with the appliance and allow customers to pay annual customer support fees at an average rate of 22% of the related product price. We further note that it appears that this change resulted in a change to up-front revenue recognition of the residual amount calculated in accordance with SOP 98-9 as compared to your prior policy of recognizing revenue over the term during which the blades would be delivered. Please explain to us in detail, how you were able to conclude that you had established VSOE of the customer support related to this specific product in accordance with your stated policy of using historical evidence of stand-alone sales to third parties. In addition, explain to us the nature of the content blades, their affect on your previous revenue recognition policy and the relevance of only bundling “most” of these blades with the Proventia appliance under your new policy.
Company Response:
The pricing model change was made primarily to align the integrated security appliance pricing model with our historical pricing model and our pricing model for our other appliances (e.g. intrusion detection and intrusion prevention appliances) and to better meet customer demands. The content blades were for specific security functions including: firewall, virtual private networking (“VPN”), antivirus, intrusion prevention systems (“IPS”), intrusion detection systems (“IDS”), and content filtering. With our historical model for all other security appliances, all functionality is included with the appliance (i.e. perpetual license for all software technology is included in the list price of the security appliance). Under the integrated security appliance pricing model (prior to change) the customer would purchase the appliance and subscribe to different blades only as needed. All of the software technology included with the integrated security appliance is owned by ISS with the exception of the anti-virus technology. As a result, we decided to charge an additional fee for the anti-virus blade while including all other functionality in the standard list price. This is the reason “most” were bundled with the appliance under our new policy.
The pricing model change during the second quarter of 2005, related to only the integrated security appliances. This change did not have a material impact on our results
3
for the quarter as the integrated security appliances represented only 3% (or approximately $900 thousand) of product license and sales revenues for the quarter (and only 1% of total revenues), which approximated the percentage of quarterly product licenses and sales that it had historically represented since introduced in late 2003, under the prior pricing model. Additionally, the increase in license revenue for the integrated security appliance from first quarter 2005 was only 0.6% (or approximately $200 thousand) of product license and sales revenues for the quarter (and only 0.25% of total revenues).
We concluded we had established VSOE of fair value of the customer support related to this specific product for the following reasons: (i) it was our historical pricing model; (ii) it was the pricing model being used on our other appliances (which had significantly greater revenues); and (iii) the customer support platform for the integrated security appliance is the same as for our other appliances. Accordingly, the stand alone sales of our other appliances, which were priced similarly, supported VSOE of fair value for the integrated security appliance. Essentially, this change aligned the pricing of an appliance with relatively small revenues to our other products.
Note 11. Segments and Geographic Information
4. Staff Comment:
Please explain to us how you have considered providing information about products and services and revenues from individually material countries in accordance with paragraphs 37 and 38 of SFAS 131.
Company Response:
We have considered the provisions of paragraph 37 of SFAS 131 to disclose separately revenue for each product and service. It requires disclosure for each product and service or each group of similar products and services unless it is impracticable to do so. In our income statement we disclose the following three categories of revenues: (i) product licenses and sales; (ii) subscriptions; and (iii) professional services. ISS conducts business in one operating segment: providing information security management. Although we have different products, they all perform a similar function of providing information security. Accordingly, we do not believe our products meet the criteria for further disclosure under SFAS 131.
With respect to subscriptions revenues, we have determined that we have two types of services that meet the requirements to be disclosed separately under SFAS 131: (i) product content and support (or maintenance); and (ii) managed security services. Product content and support and managed security services revenues were $105 million and $45 million; $90 million and $38 million; and $76 million and $27 million,
4
respectively, for the years ended 2005, 2004, and 2003, respectively. Our future filings will be changed to include separate disclosure of these items.
We have considered the provisions of paragraph 38 of SFAS 131 to disclose separately revenues from individual foreign countries that are material. We believe our disclosure by geographic region of Americas, EMEA, and Asia/Pacific is useful information for investors, and that additional disclosure at the country level is not required or useful because no single foreign country has revenues that are material for separate disclosure. For the years ended 2005, 2004, and 2003, the foreign country with the most revenues, Japan, had total revenues as a percentage of consolidated revenues of 10.5%, 9.1%, and 10.1%, respectively.
Note 14. Quarterly Financial Results (Unaudited)
5. Staff Comment:
Please explain to us how your presentation complies with Item 302(a) of Regulation S-K that requires you to present gross profit.
Company Response:
In our presentation of Quarterly Financial Results (unaudited) we did not provide gross profit. However, we did provide operating income, which is used by management to evaluate results, and we believe is an important measure of performance for our company and industry. To comply with the requirements of Item 302(a) of Regulation S-K in our future filings, we will include gross profit (along with operating income) in the Quarterly Financial Results (unaudited) disclosure.
Form 8-K filed April 25, 2006
Exhibit 99.1
6. Staff Comment:
We note that the non-GAAP information furnished in your earnings release does not appear consistent with our guidance and requirements regarding non-GAAP information. Following are such inconsistencies in greater detail:
· The presentation includes numerous non-GAAP measures including, but not limited to, non-GAAP cost of product licenses and sales, non-GAAP cost of subscription and professional services expense, non-GAAP R&D expenses, non-GAAP sales and marketing expense, and non-GAAP general and administrative expense. Note that each line item, sub-total or total, for which an adjustment has been made, represents a
5
separate non-GAAP measure that must be separately identified and addressed in the accompanying disclosure. See Items 10(e)(1)(i)(C), 10(e)(1)(i)(D) and 10(e)(2) of Regulation S-K.
· As each of the non-GAAP measures appears to exclude items that may be considered recurring in nature, you must meet the burden of demonstrating the usefulness of each measure and clearly disclose why each non-GAAP measure is useful when these items are excluded. See Question 8 of the Frequently Asked Questions Regarding the Use of Non-GAAP Financial Measures.
· In view of the nature, content and format of the presentation, we question whether it complies with Item 100(b) of Regulation G. In this regard we note that the presentation of a full non-GAAP Statement of Operations may create the unwarranted impression that the presentation is based on a comprehensive set of accounting rules or principles.
Company Response:
In light of the comments above and further consideration we propose to change our future earnings releases as follows:
· Remove full non-GAAP Statement of Operations;
· Retain the reconciliations of GAAP to non-GAAP financial measures as is, with the result that only the following non-GAAP financial measures will be presented: operating income, income before income taxes, net income, operating margin and net income per dilutive share. We believe this would be acceptable as it would allow us to present the amount of expense related to share-based payment arrangements included in specific line items in the financial statements (as permitted under SAB 107), while not creating new non-GAAP financial measures. See our proposed “Non-GAAP Financial Measures” disclosure below and our response to your second bullet point for ISS’ position on the usefulness of these measures.
· Amend our non-GAAP Financial Measures explanation to be as follows:
“This press release and the accompanying supplementary financial information presents operating income, income before income taxes, net income, operating margin and net income per dilutive share measures that exclude the effect of non-cash acquisition related expenses and stock-based compensation expense relating to FAS 123(R). ISS’ management and industry analysts often evaluate ISS’ operating performance using these measures. These non-GAAP financial measures are also used by management to conduct business operations such as: developing budgets, managing expenditures, evaluating internal performance and calculating incentive compensation. In addition, ISS believes these non-GAAP financial measures facilitate management’s internal comparisons to its competitors’ operating results, and the software industry in general. ISS believes that its presentation of these non-GAAP measures provide useful information to investors as a measure of operating performance basic to its ongoing operations, which is more comparable from period to period without the charges related to occasional acquisition activity and non-cash stock-based compensation expense. Additionally, ISS believes these non-GAAP measures provide useful information to investors so they can evaluate ISS’ operating results in the same manner as management and industry analysts, if they so choose.
6
This non-GAAP financial information is provided as additional information for investors is not in accordance with generally accepted accounting principles and may be different from similarly named non-GAAP financial measures used by other companies. Non-GAAP financial measures should not be used as a substitute for, or considered superior to, measures of financial performance prepared in accordance with generally accepted accounting principles.”
Our responses to the issues raised in the bullet points to your comment 6 are as follows:
First Bullet Response:
In our reconciliation of GAAP to non-GAAP financial information we included the amount of each income statement line item affected by stock-based compensation expense as part of the reconciliation. Our purpose of presenting it in this manner was not to create separate non-GAAP measures, but to provide useful investor information about the impact of the adoption of SFAS 123R. According to SAB 107 F, Classification of Compensation Expense Associated with Share-Based Payment Arrangements, “the staff believes a company could consider disclosing the amount of expense related to share-based payment arrangements included in specific line items in the financial statements. Disclosure of this information might be appropriate in a parenthetical note to the appropriate income statement line item, on the cash flow statement, in the footnotes to the financial statements, or within MD&A.” We elected to make this disclosure as part of our GAAP to non-GAAP reconciliation. Refer to our response above for how we plan to present this information in future filings.
Second Bullet Response:
As stated above, ISS proposes to limit its non-GAAP financial measures to operating income, income before income taxes, net income, operating margin and net income per dilutive share. These measures exclude two non-cash expense items: (i) amortization of acquired technology and other intangibles; and (ii) stock-based compensation expense; both of which we acknowledge are recurring in nature. Question 8 of the Frequently Asked Questions Regarding the Use of Non-GAAP Financial Measures does not prohibit the exclusion of a recurring item in a non-GAAP presentation, but it does require that registrants demonstrate the usefulness of any non-GAAP measure that does so.
We believe that our presentation of non-GAAP measures that exclude these two items provides useful information to investors as a measure of operating performance basic to our ongoing operations, which is more comparable from period to period without the charges related to occasional acquisition activity and non-cash stock-based compensation expense. Additionally, we believe these non-GAAP measures provide useful information to investors so they can evaluate ISS’ operating results in the same manner as management and industry analysts if they so choose. ISS uses non-GAAP measures to conduct business operations such as:
7
developing budgets, managing expenditures, evaluating internal performance, and calculating incentive compensation.
We do not believe that our non-GAAP presentation is more accurate than, or more important than, our GAAP results; we do not include non-GAAP measures in our SEC filings (only in earnings release); and we have displayed our GAAP results prominently in our earnings release. When non-GAAP results have been presented, we have cautioned that the non-GAAP financial measure should not be used as a substitute for, or considered superior to, measures of financial performance prepared in accordance with GAAP.
Refer to our response above for how we plan to present this information in future filings.
Third Bullet Response:
Although we intend to omit the full non-GAAP Statement of Operations from future earnings releases, we submit that the presentation of a full non-GAAP Statement of Operations complies with Item 100(b) of Regulation G and does not create the unwarranted impression that the presentation is based on a comprehensive set of accounting rules or principles, for the following reasons:
· The non-GAAP statement is clearly identified as being non-GAAP;
· The GAAP statement of operations is prominently displayed and presented first;
· ISS clearly states that the non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles and may be different from non-GAAP financial measures used by other companies; and
· ISS has consistently cautioned that non-GAAP financial measure should not be used as a substitute for, or considered superior to, measures of financial performance prepared in accordance with GAAP.
* * * * * * *
The Company acknowledges the following:
· The Company is responsible for the adequacy and accuracy of the disclosure in its filings;
· Staff comments or changes to disclosure in response to staff comments do not foreclose the Commission from taking any action with respect to the filing; and
· The Company may not assert staff comments as a defense in any proceeding initiated by the Commission or any person under the federal securities laws of the United States.
If the Staff has any questions or further comments, please direct them to the undersigned at (404) 236-4064, or to Jay Hopkins, the Company’s Corporate Controller, at (404) 236-4012.
| Sincerely, |
|
|
| Raghavan Rajaji |
| Senior Vice President and Chief Financial Officer |
8