THE OWASP FOUNDATION, INC. AND AFFILIATECOMBINED FINANCIAL STATEMENTS
DECEMBER 31, 2019

THE OWASP FOUNDATION, INC. AND AFFILIATE
Contents
December 31, 2019

Pages
Independent Auditor's Report .........................................................................................................

1

Combined Financial Statements:
Combined Statement of Financial Position ...................................................................................

2

Combined Statement of Activities and Changes in Net Assets .....................................................

3

Combined Statement of Cash Flows .............................................................................................

4

Combined Statement of Functional Expenses ..............................................................................

5

Notes to Combined Financial Statements .....................................................................................

6 - 11

50 Washington Street
Westborough, MA 01581
508.366.9100
aafcpa.com

Independent Auditor's Report

To the Board of Directors of
The OWASP Foundation, Inc. and Affiliate:
Report on the Combined Financial Statements
We have audited the accompanying combined financial statements of The OWASP Foundation, Inc. (aDelaware corporation, not for profit) and Affiliate, which comprise the combined statement of financial
position as of December 31, 2019, and the related combined statements of activities and changes in net
assets, cash flows and functional expenses for the year then ended, and the related notes to the
combined financial statements.
Management’s Responsibility for the Combined Financial Statements
Management is responsible for the preparation and fair presentation of these combined financial
statements in accordance with accounting principles generally accepted in the United States of America;
this includes the design, implementation, and maintenance of internal control relevant to the
preparation and fair presentation of combined financial statements that are free from material
misstatement, whether due to fraud or error.
Auditor’s Responsibility
Our responsibility is to express an opinion on these combined financial statements based on our audit.
We conducted our audit in accordance with auditing standards generally accepted in the United Statesof America. Those standards require that we plan and perform the audit to obtain reasonable assurance
about whether the combined financial statements are free from material misstatement.
An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in
the combined financial statements. The procedures selected depend on the auditor’s judgment,
including the assessment of the risks of material misstatement of the combined financial statements,
whether due to fraud or error. In making those risk assessments, the auditor considers internal control
relevant to the entity’s preparation and fair presentation of the combined financial statements in orderto design audit procedures that are appropriate in the circumstances, but not for the purpose of
expressing an opinion on the effectiveness of the entity’s internal control. Accordingly, we express nosuch opinion. An audit also includes evaluating the appropriateness of accounting policies used and thereasonableness of significant accounting estimates made by management, as well as evaluating theoverall presentation of the combined financial statements.
We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis forour audit opinion.
OpinionIn our opinion, the combined financial statements referred to above present fairly, in all material
respects, the combined financial position of The OWASP Foundation, Inc. and Affiliate as of December
31, 2019, and the changes in their net assets and their cash flows for the year then ended in accordancewith accounting principles generally accepted in the United States of America.

Boston, Massachusetts
September 28, 2020
Page 1

THE OWASP FOUNDATION, INC. AND AFFILIATE
Combined Statement of Financial Position
December 31, 2019

AssetsCurrent Assets:
Cash
Accounts receivable, net
Prepaid expenses
Inventory
Total assets$ 1,237,171
427,566
111,277
42,306$ 1,818,320

Liabilities and Net Assets
Current Liabilities:
Accounts payable
Accrued expenses
Deferred revenue$

132,201
18,305543,332

Total current liabilities

693,838

Net Assets:
Without donor restrictions:Operating
Cumulative adjustment for foreign currencytranslation adjustment

955,250

Total without donor restrictions
With donor restrictions
Total net assets
Total liabilities and net assets

The accompanying notes are an integral part of these combined statements.

635
955,885
168,597
1,124,482$ 1,818,320

Page 2

THE OWASP FOUNDATION, INC. AND AFFILIATE
Combined Statement of Activities and Changes in Net Assets
For the Year Ended December 31, 2019

Without
Donor
Restrictions

With
Donor
Restrictions

Operating Revenue and Support:
Conference
Membership fees
Contributions and grants
Other
Net assets released from purpose restrictions$ 3,057,738
208,459
12,68644,84962,768$

Total operating revenue and support

Total

‐
138,972
92,393‐(62,768)$ 3,057,738
347,431
105,079
44,849‐3,386,500

168,597

3,555,097

3,223,149
179,715
59,904‐‐‐

3,223,149
179,715
59,904

3,462,768‐

3,462,768(76,268)

168,597

92,329Non‐Operating Expense:
Foreign currency translation adjustment

(801)

‐

(801)

Changes in net assets(77,069)

168,597

91,5281,032,954‐

1,032,954

955,885$ 168,597$ 1,124,482

Operating Expenses:
ProgramManagement and generalFundraising
Total operating expenses
Changes in net assets from operations

Net Assets:
Beginning of year
End of year$

The accompanying notes are an integral part of these combined statements.

Page 3

THE OWASP FOUNDATION, INC. AND AFFILIATE
Combined Statement of Cash Flows
For the Year Ended December 31, 2019

Cash Flows from Operating Activities:
Changes in net assets
Adjustments to reconcile changes in net assets to net cashused in operating activities:
Foreign currency translation adjustment
Bad debt
Changes in operating assets and liabilities:
Accounts receivable
Prepaid expenses
Inventory
Accounts payable
Accrued expenses
Deferred revenue
Net cash used in operating activities
Effect of Exchange Rate Changes on Cash$

91,528801463(348,781)(21,211)
9,429(15,583)(40,403)
288,640(35,117)(801)

Net Change in Cash

(35,918)

Cash:
Beginning of year

1,273,089$ 1,237,171

End of year

The accompanying notes are an integral part of these combined statements.

Page 4

THE OWASP FOUNDATION, INC. AND AFFILIATE
Combined Statement of Functional Expenses
For the Year Ended December 31, 2019

ProgramPayroll:
Salaries and wages
Payroll taxes and employee benefits$ 31,452
6,393

605,517

113,534

37,845756,8962,010,541
162,126
107,745
100,337
84,07492,00631,88926,231
1,174
1,139
370

‐
‐
20,202
18,813
15,764
‐
5,979
4,919
220
214
70

‐
‐
6,734
6,271
5,255
‐
1,993
1,639
73
71
23

2,010,541
162,126
134,681
125,421
105,093
92,00639,86132,789
1,467
1,424
463

2,617,632

66,18122,0592,705,872$ 3,223,149$ 179,715$ 59,904$ 3,462,768

The accompanying notes are an integral part of these combined statements.

Page 5

Other:
Conference
Chapter
Professional fees
Travel and entertainment
Office supplies and expenses
Program
Marketing
Bank charges
Insurance
VAT expense
Bad debt
Total otherTotal operating expenses

503,224
102,293$

Total
Expenses

Fundraising

94,354
19,180Total payroll$

Management
andGeneral$629,030
127,866

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 2019
1.

OPERATIONS AND NONPROFIT STATUSThe OWASP Foundation, Inc. (OWASP) is a not-for-profit entity that is an open community
dedicated to enabling organizations to develop, purchase, and maintain software applications
that can be trusted. All of OWASP's tools, documents, forums, and chapters are free and open
to anyone interested in improving application security. OWASP advocates approaching
application security as a people, process, and technology problem because the most effective
approaches to application security include improvements in all these areas.
OWASP is a new kind of organization. Freedom from commercial pressures allows OWASP toprovide unbiased, practical, cost effective information about application security. OWASP is notaffiliated with any technology company, although OWASP supports the informed use ofcommercial security technology. Similar to many open-source software projects, OWASP
produces many types of materials in a collaborative, open way.
OWASP Europe VZW (the Affiliate) is a Belgian not-for-profit organization established toorganize knowledge-sharing activities and undertake activities that directly or indirectly
contribute to the achievement of OWASP's aims. OWASP and the Affiliate (collectively, theFoundation) are affiliates through common Board of Directors.
OWASP is exempt from Federal income taxes as a foundation (not a private foundation) formed
for charitable purposes under Section 501(c)(3) of the Internal Revenue Code (IRC). OWASP is
also exempt from state income taxes. Donors may deduct contributions made to OWASP within
IRC requirements.

2.

SIGNIFICANT ACCOUNTING POLICIESThe Foundation prepares its combined financial statements in accordance with generally
accepted accounting standards and principles (U.S. GAAP) established by the Financial
Accounting Standards Board (FASB). References to U.S. GAAP in these notes are to the FASB
Accounting Standards Codification (ASC).
Basis of Presentation
The combined financial statements include the accounts of OWASP and the Affiliate.
material intercompany accounts and transactions have been eliminated.

All

Recently Adopted Accounting Pronouncements
In 2019, the Foundation adopted FASB’s Accounting Standards Update (ASU) 2018-08, Not-forProfit Entities (Topic 958): Clarifying the Scope and the Accounting Guidance for Contributions
Received and Contributions Made. This ASU clarifies and improves guidance for contributions
received and contributions made and provides guidance to organizations on how to account for
certain exchange transactions. In addition, it clarifies whether a contribution is conditional. As
a result, it enhances comparability of financial information among not-for-profit entities. The
Foundation adopted ASU 2018-08 using a modified prospective method effective January 1,
2019. Under the modified prospective method, this ASU only applies to agreements notcompleted or entered into (revenue or expense that has not yet been recognized) as of January
1, 2019. As a result, there was no cumulative-effect adjustment to opening net assets as ofJanuary 1, 2019.

Page 6

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 20192.

SIGNIFICANT ACCOUNTING POLICIES (Continued)
Recently Adopted Accounting Pronouncements (Continued)
During 2019, the Foundation also adopted FASB’s ASU 2014-09, Revenue from Contracts with
Customers (Topic 606), with respect to its revenue recognition policies. The core principle of the
new accounting guidance is that an entity should recognize revenue when it transfers promised
goods or services to customers in an amount that reflects the consideration to which the entity
expects to be entitled in exchange for those goods or services. The Foundation adopted ASU
2018-08 using a modified prospective method effective January 1, 2019. Under the modified
prospective method, this ASU only applies to agreements not completed or entered into
(revenue or expense that has not yet been recognized) as of January 1, 2019. The adoption ofthis standard did not have a significant impact on the Foundation’s combined financial
statements as substantially all of the Foundation’s revenues are recognized across the year asservices are provided to the customers.
Accounts Receivable and Allowance for Doubtful Accounts
Accounts receivable are carried at the original invoice amount less an estimate of doubtfulreceivables. Accounts receivable are written off when deemed uncollectible. Recoveries ofreceivables previously written off are recorded as revenue when received.
An allowance for potentially uncollectible accounts receivable is provided based upon
management’s assessment of potential defaults. This assessment includes such factors ascollection history and type of receivable. There was an allowance of $9,013 as of December 31,
2019.
Inventory
Inventory is stated at the lower of cost or market value. Cost is determined on an average cost
method. Market value is determined based on net realizable value. Appropriate consideration
is given to obsolescence, excessive levels, deterioration, and other factors in evaluating net
realizable value.
Property and Equipment and Depreciation
Property and equipment are recorded at cost, if purchased, or at fair value at the time ofdonation. Renewals and betterments with an expected life greater than one year are
capitalized, while repairs and maintenance are expensed as incurred.
Property and equipment are depreciated using the straight-line basis over estimated useful livesof three years and consist of the following as of December 31, 2019:
Equipment
WebsiteLess - accumulated depreciation$ 40,863
30,00070,86370,863$-

Page 7

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 20192.

SIGNIFICANT ACCOUNTING POLICIES (Continued)
Net Assets
Net Assets Without Donor Restrictions
Net assets without donor restrictions are those net resources that bear no external restrictions
and are generally available for use by the Foundation. The Foundation has grouped its net
assets without donor restrictions into the following categories:•

Operating Net Assets consist of amounts relating to program and other operating
activities, which bear no external restrictions and are generally available for operations.

•

Cumulative Adjustment for Foreign Currency Translation Adjustment Net Assets
represent the cumulative effect of translating the Affiliate's financial activities andposition into the Foundation's reporting currency (U.S. dollars).

Net Assets With Donor Restrictions
Net assets with donor restrictions represent amounts received or committed with donor
restrictions which have not yet been expended for their designated purposes (purpose
restricted), amounts for unrestricted use in future periods (time restricted), and amounts
received from donors with the stipulation that the principal will be held in perpetuity and only
the investment income can be spent. All net assets with donor restrictions are purpose
restricted as of December 31, 2019.
Revenue Recognition
The Foundation generally measures revenue for qualifying exchange transactions based on theamount of consideration the Foundation expects to be entitled for the transfer of goods orservices to a customer, then recognizes this revenue when or as the Foundation satisfies its
performance obligations under a contract, except in transactions where U.S. GAAP provides
other applicable guidance. The Foundation evaluates its revenue contracts with customers
based on the five-step model under ASC Topic 606: (1) Identify the contract with the customer;(2) Identify the performance obligations in the contract; (3) Determine the transaction price; (4)Allocate the transaction price to separate performance obligations; and (5) Recognize revenue
when (or as) each performance obligation is satisfied.
The Foundation receives conference fees for registrations for various events and conferences.
Conference revenue is recognized at a point in time when the conference occurs. Deferred
revenue in the accompanying combined statement of financial position consists of event
registration fees paid in advance that have not been earned as of December 31, 2019. Other
revenue is recognized as earned.
In accordance with ASC Subtopic 958-605, Revenue Recognition, the Foundation must determine
whether a contribution (or a promise) is conditional or unconditional for transactions deemed to
be a contribution. A contribution is considered to be a conditional contribution if an agreement
includes a barrier that must be overcome and either a right of return of assets or a right of
release of a promise to transfer assets exists. Indicators of a barrier include measurable
performance-related barrier or other measurable barriers, a stipulation that limits discretion by
the recipient on the conduct of an activity, and stipulations that are related to the purpose of
the agreement. Topic 958 prescribes that the Foundation should not consider probability ofcompliance with the barrier when determining if such awards are conditional and should bereported as conditional grant advance liabilities until such conditions are met.

Page 8

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 20192.

SIGNIFICANT ACCOUNTING POLICIES (Continued)
Revenue Recognition (Continued)
Membership fees do not have an intrinsic benefit and are considered a donation. The
Foundation recognizes the revenue under ASC Subtopic 958-605 at the time of the donation.
Contributions and grants are recorded as revenue when received or unconditionally pledged.
Restricted contributions and grants are recorded as net assets with donor restrictions when
received or unconditionally pledged. Transfers are made to net assets without donor
restrictions as costs are incurred or time restrictions or program restrictions have lapsed.
Expense Allocations
Expenses related directly to a program or function are distributed to that program or function,
while other expenses are allocated to programs or functions based upon management’s
estimate of the percentage attributable to each program or function. The expenses that areallocated include payroll, miscellaneous, professional fees, travel and entertainment, officesupplies and expenses, marketing, bank charges, insurance, VAT expense, and bad debt, which
are allocated based on management’s estimate of usage or time spent on various functions.
Chapter expenses of $162,126, included in the accompanying combined statement of activities
and changes in net assets, consist of reimbursements to members for travel, meals andentertainment for the year ended December 31, 2019.
Foreign Currency Translation
The financial activity of the Affiliate is translated in accordance with the provisions of the ASC
Topic, Foreign Currency Matters. Under these provisions, current assets and liabilities of theAffiliate are translated into U.S. dollars at year-end exchange rates. Property and equipment aretranslated at the exchange rate in effect at acquisition. Revenue and expenses are translated at
the average rates in effect during the year. Translation effects are shown within non-operating
section of the combined statement of activities and changes in net assets.
Estimates
The preparation of combined financial statements in accordance with U.S. GAAP requires
management to make estimates and assumptions that may affect the reported amounts ofassets and liabilities and the disclosure of contingent assets and liabilities as of the date of the
combined financial statements and the reported amounts of revenues and expenses during thereporting periods. Actual results could differ from these estimates.
Income Taxes
The Foundation accounts for uncertainty in income taxes in accordance with ASC Topic, Income
Taxes. This standard clarifies the accounting for uncertainty in tax positions and prescribes arecognition threshold and measurement attribute for the combined financial statements
regarding a tax position taken or expected to be taken in a tax return. The Foundation has
determined that there are no uncertain tax positions which qualify for either recognition or
disclosure in the combined financial statements at December 31, 2019. The Foundation's
information returns are subject to examination by the Federal and state jurisdictions.

Page 9

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 20192.

SIGNIFICANT ACCOUNTING POLICIES (Continued)
Fair Value Measurements
The Foundation follows the accounting and disclosure standards pertaining to Fair Value
Measurements for qualifying assets and liabilities. Fair value is defined as the price that theFoundation would receive upon selling an asset or pay to settle a liability in an orderlytransaction between market participants.
The Foundation uses a framework for measuring fair value that includes a hierarchy thatcategorizes and prioritizes the sources used to measure and disclose fair value. This hierarchy isbroken down into three levels based on inputs that market participants would use in valuing thefinancial instruments based on market data obtained from sources independent of theFoundation. Inputs refer broadly to the assumptions that market participants would use inpricing the financial instrument, including assumptions about risk. Inputs may be observable orunobservable. Observable inputs are inputs that reflect the assumptions market participants
would use in pricing the financial instrument developed based on market data obtained fromsources independent of the reporting entity. Unobservable inputs are inputs that reflect thereporting entity’s own assumptions about the assumptions market participants would use inpricing the asset developed based on the best information available. The three-tier hierarchy of
inputs is summarized in the three broad levels as follows:
Level 1: Inputs that reflect unadjusted quoted prices in active markets for identicalassets at the measurement date.
Level 2: Inputs other than quoted prices that are observable for the asset either directly
or indirectly, including inputs in markets that are not considered to be active.
Level 3: Inputs that are unobservable and which require significant judgment or
estimation.
An asset or liability's level within the framework is based upon the lowest level of any input thatis significant to the fair value measurement. All qualifying assets and liabilities are valued using
Level 1 inputs.
Subsequent Events
Subsequent events have been evaluated through September 28, 2020, which is the date the
combined financial statements were available to be issued. See Note 6 for disclosure of asubsequent events.

3.

CONCENTRATIONS
Credit Risk
The Foundation maintains their cash balances in United States banks. At certain times during
the year, the cash balances in some of the accounts exceed the maximum amount of insurance
provided by the Federal Deposit Insurance Corporation. The Foundation has not experienced
any losses in such accounts. The Foundation also maintains one bank account in euros that had
a balance totaling $14,003 as of December 31, 2019.
Economic Dependency
At December 31, 2019, 86% of operating revenue is from four annual conferences.

Page 10

THE OWASP FOUNDATION, INC. AND AFFILIATE
Notes to Combined Financial Statements
December 31, 20193.

CONCENTRATIONS (Continued)
Net Assets in Foreign Countries
Net assets in Europe of $6,477 are included in the accompanying combined statement offinancial position as of December 31, 2019.

4.

CONTINGENCY
In the ordinary course of business, the Foundation is from time-to-time a party to various claims
and lawsuits. If management determines, based on the underlying facts and circumstances, that
it is probable a loss will result from a litigation contingency and the amount of the loss can bereasonably estimated, the estimated loss is accrued for. Management does not expect any
adverse financial impact from open litigation matters occurring in the normal course of businessas of December 31, 2019.

5.

LIQUIDITY
Financial assets available for general operating use, that is, without donor or other restrictions
limiting their use within one year of the combined statement of financial position date, comprisethe following at December 31, 2019:
Cash
Accounts receivable$ 1,237,171
427,566$ 1,664,737

The Foundation has a policy to structure its financial assets to be available and liquid as its
obligations become due. As of December 31, 2019, the Foundation has financial assets equal toapproximately six months operating expenses.
6.

SUBSEQUENT EVENTSIn March 2020, the COVID-19 coronavirus (COVID-19) pandemic emerged in the United States
triggering widespread government mandated and voluntary business closures, which in turnhave led to substantial interruptions in financial markets, employment and the economy as awhole. Though the potential financial effects cannot be reasonably estimated at this time, thesecircumstances may have adverse effects on the Foundation, its operations and future combined
financial statements. The accompanying combined financial statements have not been adjusted
for any potential financial effects that may occur in the future related to the current uncertainty.
Management of the Foundation is monitoring these events and their borrowers closely to assess
the financial impact of the situation and determine appropriate courses of action. As of the dateof this report, the Foundation is unable to accurately predict how COVID-19 will affect theresults of its operations because the disease’s severity and the duration of the outbreak areuncertain.
In April 2020, the Foundation has applied for and was awarded a loan from the Paycheck
Protection Program established by the Coronavirus Aid, Relief and Economic Security Act (CARESAct) in the amount of $112,700. The funds will be used to pay certain payroll costs including
benefits during a twenty-four-week period. A portion of these funds may be forgiven, as
defined in the agreement, at the end of the twenty-four-week period and the remainder of thefunds will be due with interest at 1%. The repayment will be deferred until November 2020
when the note, plus interest, will be due in equal monthly payments through April 2022.

Page 11