THE OWASP FOUNDATION, INC. AND AFFILIATECOMBINED FINANCIAL STATEMENTSANDINDEPENDENT AUDITORS' REPORTYEAR ENDED DECEMBER 31, 2022

Contents
Page
Independent Auditors' Report

1-2

Combined Financial Statements
Combined Statement of Financial Position

3

Combined Statement of Activities

4

Combined Statement of Functional Expenses

5

Combined Statement of Cash Flows6

Notes to Combined Financial Statements

7 - 12

Independent Auditors' Report

Board of Directors
The OWASP Foundation, Inc. and Affiliate
Wakefield, Massachusetts
OpinionWe have audited the accompanying combined financial statements of The OWASPFoundation, Inc. and Affiliate (a not-for-profit organization), which comprise the combined
statement of financial position as of December 31, 2022, and the related combined statementsof activities and cash flows for the year then ended, and the related notes to the combined
financial statements.
In our opinion, the combined financial statements referred to above present fairly, in all material
respects, the financial position of The OWASP Foundation, Inc. and Affiliate as ofDecember 31, 2022, and the changes in its net assets and its cash flows for the year thenended in accordance with accounting principles generally accepted in the United States ofAmerica.
Basis for Opinion
We conducted our audit in accordance with auditing standards generally accepted in the UnitedStates of America. Our responsibilities under those standards are further described in the
Auditors' Responsibilities for the Audit of the Combined Financial Statements section of ourreport. We are required to be independent of The OWASP Foundation, Inc. and Affiliate and tomeet our other ethical responsibilities in accordance with the relevant ethical requirements
relating to our audit. We believe that the audit evidence we have obtained is sufficient andappropriate to provide a basis for our audit opinion.
Responsibilities of Management for the Combined Financial Statements
Management is responsible for the preparation and fair presentation of the combined financial
statements in accordance with accounting principles generally accepted in the United States ofAmerica, and for the design, implementation, and maintenance of internal control relevant to
the preparation and fair presentation of combined financial statements that are free frommaterial misstatement, whether due to fraud or error.
In preparing the combined financial statements, management is required to evaluate whether
there are conditions or events, considered in the aggregate, that raise substantial doubt about
The OWASP Foundation, Inc. and Affiliate's ability to continue as a going concern within one
year after the date that the combined financial statements are available to be issued.

Page 1

Auditors' Responsibilities for the Audit of the Combined Financial Statements
Our objectives are to obtain reasonable assurance about whether the combined financial
statements as a whole are free from material misstatement, whether due to fraud or error, andto issue an auditors' report that includes our opinion. Reasonable assurance is a high level ofassurance but is not absolute assurance and therefore is not a guarantee that an audit
conducted in accordance with generally accepted auditing standards will always detect amaterial misstatement when it exists. The risk of not detecting a material misstatement resulting
from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery,
intentional omissions, misrepresentations, or the override of internal control. Misstatements are
considered material if there is a substantial likelihood that, individually or in the aggregate, theywould influence the judgment made by a reasonable user based on the combined financial
statements.
In performing an audit in accordance with generally accepted auditing standards, we:

Exercise professional judgment and maintain professional skepticism throughout the audit.



Identify and assess the risks of material misstatement of the combined financial statements,
whether due to fraud or error, and design and perform audit procedures responsive to thoserisks. Such procedures include examining, on a test basis, evidence regarding the amounts
and disclosures in the combined financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit
procedures that are appropriate in the circumstances, but not for the purpose of expressing
an opinion on the effectiveness of The OWASP Foundation, Inc. and Affiliate' internal
control. Accordingly, no such opinion is expressed.



Evaluate the appropriateness of accounting policies used and the reasonableness ofsignificant accounting estimates made by management, as well as evaluate the overall
presentation of the combined financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in theaggregate, that raise substantial doubt about The OWASP Foundation, Inc. and Affiliate'
ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among othermatters, the planned scope and timing of the audit, significant audit findings, and certain
internal control related matters that we identified during the audit.

March 1, 2024

Page 2

The OWASP Foundation, Inc. and Affiliate
Combined Statement of Financial Position
December 31, 2022
AssetsCurrent Assets
Cash and cash equivalents
Accounts receivable
Prepaid expenses
Total Current Assets
Total Assets$

2,783,533
38,114
95,623
2,917,270$

2,917,270$

733,932
113,669
847,601

Liabilities and Net Assets
Current Liabilities
Accounts payable
Deferred revenue
Total Current Liabilities
Net Assets
Without donor restrictions
Total Net Assets
Total Liabilities and Net Assets

See notes to combined financial statements

2,069,669
2,069,669$

2,917,270

Page 3

The OWASP Foundation, Inc. and Affiliate
Combined Statement of Activities
Year Ended December 31, 2022
Without Donor
Restrictions
Revenue, Gains and Other Support
Conferences
Membership fees
Contributions
Other
Satisfaction of time and usage
restrictions
Total Revenues, Gains andOther Support$

1,836,789 $
276,176
67,031
55,580With Donor
Restrictions

Total

- $
683,250
117,800-

1,836,789
959,426
184,83155,580869,363(869,363)-

3,104,939(68,313)

3,036,626

Expenses
Program Services

1,791,180-

1,791,180

Supporting Activities
Management and general
Membership retention
Total Supporting Activities
Total Expenses

335,846
111,949447,795
2,238,975-

335,846
111,949447,795
2,238,975

865,964(68,313)797,651

1,203,705

68,313

1,272,018

Change in Net Assets
Net Assets, Beginning of YearNet Assets, End of Year$See notes to combined financial statements

2,069,669 $- $2,069,669

Page 4

The OWASP Foundation, Inc. and Affiliate
Combined Statement of Functional Expenses
Year Ended December 31, 2022
Supporting Activities
ProgramServices
Salaries and Related Expenses
Salaries
Payroll taxes and benefits
Total Salaries and Related Expenses
Other Expenses
Conferences
Professional fees
Local chapter expenses
Software and website
Project expenses
TravelChapter outreachBank service charges
Training
Insurance
Supplies and materials
Associate expenses
Telephone and postage
Marketing and merchandise
Total Expenses

See notes to combined financial statements$

492,045
164,740
656,785

Management Membershipand generalretention$

667,103
144,330
75,87149,40649,31544,79833,361
26,37816,185
7,258
6,410
6,156
5,886
1,938
$ 1,791,180

$

Total
Supporting
Services

Total
Expenses

92,258 $30,889123,147

30,753 $10,296
41,049123,011
41,185
164,196$

615,056
205,925
820,981

125,082
27,062
14,226
9,264
9,247
8,399
6,255
4,946
3,034
1,361
1,202
1,154
1,104
363

41,694
9,020
4,742
3,088
3,082
2,800
2,085
1,648
1,012
454
401
385
368
121

166,776
36,082
18,96812,352
12,329
11,199
8,340
6,594
4,046
1,815
1,603
1,539
1,472
484

833,879
180,41294,83961,75861,64455,99741,701
32,972
20,231
9,073
8,013
7,695
7,358
2,422

335,846 $111,949 $447,795$ 2,238,975

Page 5

The OWASP Foundation, Inc. and Affiliate
Combined Statement of Cash Flows
Year Ended December 31, 2022
Cash Flows From Operating Activities
Change in net assets
Adjustments to reconcile changes in net assets to net cash
provided by operating activities:(Increase) decrease in assets:
Accounts receivable
Prepaid expenses
Increase (decrease) in liabilities:
Accounts payable
Deferred revenue
Net Cash Provided By Operating Activities$

797,651

125,525(45,790)
676,370(325,050)
1,228,706

Net Increase in Cash and Cash Equivalents

1,228,706

Cash and Cash Equivalents, Beginning of Year1,554,827

Cash and Cash Equivalents, End of YearSee notes to combined financial statements$

2,783,533

Page 6

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
1.

Nature of Operations and Basis of Presentation
Organization
The OWASP Foundation, Inc. and Affiliate ("OWASP", or the "Foundation") is a not-forprofit organization that is an open community dedicated to enabling organizations todevelop, purchase, and maintain software applications that can be trusted. All of theFoundation's tools, documents forums and chapters are free and open to anyone
interested in improving application security. The Foundation advocates approaching
application security as a people, process and technology problem because the mosteffective approaches to application security include improvements in all these areas.
OWASP is a new kind of organization. Freedom from commercial pressures allows
OWASP to provide unbiased, practical, cost effective information about application
security. OWASP is not affiliated with any technology company, although OWASP
supports the informed use of commercial security technology. Similar to many opensource software projects, OWASP produces many types of materials in a collaborative,
open way.
The Foundation's European affiliate, VZW ("the Affiliate") is a Belgian not-for-profit
organization established to organize knowledge-sharing activities and undertake
activities that directly or indirectly contribute to the achievement of the Foundation's
aims. The Foundation and the Affiliate (collectively, the "Organization") are affiliates
through common Board of Directors.
Basis of Presentation
The accompanying combined financial statements have been prepared in accordancewith the provisions of the Financial Accounting Standards Board ("FASB"), AccountingStandards Codification (the "FASB ASC"), which is the source of authoritative, nongovernmental accounting principles generally accepted in the United States of America("GAAP"). All references to authoritative accounting guidance contained in our
disclosures are based on the general accounting topics within the FASB ASC.
Net assets and revenues, expenses, gains, and losses are classified based on theexistence or absence of donor-imposed restrictions. Accordingly, net assets of theOrganization and changes therein are classified into two categories of net assets, asapplicable, and reported as follows:
Net assets without donor restrictions - Net assets that are not subject to donor-imposed
stipulations. Board designated funds are established by the Board of Directors andrepresent net assets without donor restrictions that have been set aside fordiscretionary purposes.
Net assets with donor restrictions - Net assets subject to donor-imposed stipulations
that may be satisfied by specific activities or the passage of time, or are required to be
maintained in perpetuity by the Organization.

Page 7

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
2.

Summary of Significant Accounting Policies
Use of Estimates
The preparation of financial statements in conformity with GAAP requires management
to make estimates and assumptions that affect certain reported amounts anddisclosures. Accordingly, actual results could differ from those estimates.
Fair Value Measurements
The Organization follows guidance issued by the FASB on fair value measurements,
which establishes a framework for measuring fair value, clarifies the definition of fairvalue within that framework, and expands disclosures about the use of fair value
measurements. This guidance applies whenever fair value is the applicablemeasurement. The three general valuation techniques used to measure fair value are
the market approach, cost approach, and income approach.
Cash and Cash Equivalents
The Organization considers all short-term investments with an original maturity of threemonths or less at the time of purchase to be cash equivalents.
Foreign Currency Translation
The financial activity of the Affiliate is translated in accordance with the provision of the
ASC Topic 830, Foreign Currency Matters. Under these provisions, current assets andliability of the affiliate are translated into U.S. dollars at year-end exchange rates.
Property and equipment are translated at the exchange rate in effect at acquisition.
Revenue an expense are translated at the average rates in effect during the year.
Translation effects are shown within non-operating section of the combined statement ofactivities and changes in next assets.
Accounts Receivable and Allowance for Doubtful Accounts
Accounts receivable are carried at the original invoice amount less an estimate of
doubtful receivables. Accounts receivable are written off when deemed uncollectible.
Recoveries of receivables previously written off are recorded as revenue when received.
An allowance for potentially uncollectible accounts receivable is provided based upon
management’s assessment of potential defaults. This assessment includes such factors
as collection history and type of receivable.

Page 8

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
Property and Equipment
Purchased property and equipment are stated at cost. Major additions andimprovements are capitalized, while maintenance and repairs are expensed as incurred.
Donated assets are recorded at fair value at the date of donation. Such donations arereported as increases in net assets without donor restrictions unless the donor has
restricted the donated asset to a specific purpose or period of time. When assets are
sold or otherwise disposed of, the related cost and accumulated depreciation are
removed from the accounts. Any gain or loss arising from such disposition is included asincome or expense in the year of disposition.
Depreciation is computed using the straight line method over the estimated useful livesof the assets. Leasehold improvements are amortized over the shorter of the life of therelated asset or the term of the lease.
The estimated lives for computing depreciation and amortization on property andequipment are:Classification

Years

Equipment
Website3-5
3Long-Lived Asset Impairment
The Organization evaluates the recoverability of the carrying value of long-lived assets
whenever events or circumstances indicate the carrying amount may not berecoverable. If a long-lived asset is tested for recoverability and the undiscounted
estimated future cash flows expected to result from the use and eventual disposition of
the asset are less than the carrying amount of the asset, the asset cost is adjusted tofair value and an impairment loss is recognized as the amount by which the carrying
amount of a long-lived asset exceeds its fair value. No asset impairment was recognized
during the year ended December 31, 2022.
Deferred Revenue
Deferred revenue consists of payments the Organization receives from members forannual membership dues, before revenue is recognized. This deferred revenue isremoved when revenue is recognized. Changes in the deferred revenue balances during
the year ended December 31, 2022 were not materially impacted by other factors.

Page 9

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
Revenue Recognition
The Organization generally measures revenue for qualifying exchange transactions
based on the amount of consideration the Foundation expects to be entitled for thetransfer of goods or services to the customer, then recognized this revenue when or as
the Organization satisfies its performance obligations under a contract, except intransactions where U.S. GAAP provides other applicable guidance.
The Organization receives conference fees for registrations for various events andconferences. Conference revenue is recognized at a point in time when the conference
occurs. Deferred revenue in the accompanying combined statement of financial position
consists of event registration fees paid in advance that have not been earned as ofDecember 31, 2022. Other revenue is recognized as earned.
In accordance with ASC Subtopic 958-605, Revenue Recognition, the Organizationmust determine whether a contribution (or a promise) is conditional or unconditional fortransactions deemed to be a contribution. A contribution is considered to be a
conditional contribution if an agreement includes a barrier that must be overcome andeither a right of return of assets or a right of release of a promise to transfer assets
exists. Indicators of a barrier include measurable performance-related barriers or othermeasurable barriers, a stipulation that limits discretion by the recipient on the conduct ofan activity, and stipulation that are related to the purpose of the agreement. Topic 958
prescribes that the Organization should not consider the probability of compliance withthe barrier when determining if such awards are conditional and should be reported asconditional grant advance liabilities until such conditions are met.
Membership fees do not have an intrinsic value benefit and are considered a donation.
The Organization recognizes the revenue under ASC Subtopic 958-605 at the time ofdonation.
Contributions are recorded as revenue when received. Restricted contributions arerecorded as net assets with donor restrictions when received. Transfers are made to net
assets without donor restrictions as costs are incurred or time restrictions or program
restrictions have lapsed.
Support and Revenue
Contributions are recorded when received. All contributions are available for use unlessspecifically restricted by the donor. When a restriction expires, net assets with donor
restrictions are reclassified to net assets without donor restrictions and reported in thestatement of activities as net assets released from restrictions. Contributions with donor
restrictions in which the restrictions are met within the same year as received arereported as contributions without donor restrictions in the accompanying combined
financial statements.

Page 10

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
Donated Materials and Services (In Kind)
Donated services are recognized as contributions if the services create or enhance
nonfinancial assets or require specialized skills, are performed by people with thoseskills, and would otherwise be purchased by the Organization.
Functional Expense Allocation
The costs of program services and supporting activities have been summarized on afunctional basis in the combined statement of activities. The combined statement offunctional expenses presents the natural classification detail of expenses by function.
Accordingly, certain costs have been allocated among the program services andsupporting activities benefited.
Income Taxes
The Foundation is exempt from federal income taxes under Section 501(c)(3) of theInternal Revenue Code (the "Code"), except on net income derived from unrelated
business activities as defined in the Code. Accordingly, the Foundation files as a tax
exempt organization.
The Foundation follows guidance issued by the FASB on accounting for income taxes
and has evaluated its tax positions, expiring statutes of limitations, audits, proposed
settlements, changes in tax law and new authoritative rulings, and believes that noprovision for income taxes is necessary to cover any uncertain tax positions. The
Foundation's returns for tax years 2019 and later remain subject to examination bytaxing authorities.
Subsequent EventsThe Organization has evaluated subsequent events through March 1, 2024, the date thefinancial statements were available to be issued.
Recent Accounting Pronouncements
Credit Losses on Financial Instruments
The FASB has issued new guidance on the presentation of financial assets measured atamortized cost. Such assets will be presented at the net amount expected to becollected over their remaining contractual lives. Estimated credit losses will be based on
relevant information about historical experience, current conditions, and reasonable andsupportable forecasts that affect the collectibility of the reported amounts. The standard
will also change the accounting for credit losses related to securities available for saleand purchased financial assets with a more-than-insignificant amount of credit
deterioration since origination. The guidance will be required for the first fiscal year
beginning after December 15, 2022. Based on a preliminary analysis, the Organization
does not expect the new guidance to have a significant impact on its combined financial
statements.
Page 11

The OWASP Foundation, Inc. and Affiliate
Notes to Combined Financial Statements
December 31, 2022
3.

Property and Equipment
Property and equipment at December 31, 2022 is as follows:
Equipment
Website$40,86330,00070,86370,863-

Less accumulated depreciation and amortization$
There was no depreciation expense for the year ended 2022.
4.

Liquidity and Availability of Financial Assets
The following reflects the Organization's financial assets as of December 31, 2022
reduced by amounts not available for general use within one year because ofcontractual or donor-imposed restrictions or internal designations:
Cash and cash equivalents
Accounts receivable
Financial Assets Available to Meet Cash Needs for Expenditures
Within One Year5.

$

2,783,533
38,114$

2,821,647

Net Assets with Donor Restrictions
Net assets released from restrictions for the year ended December 31, 2022 are as
follows:$
869,363
Satisfaction of time and usage restrictions

6.

Risks and Uncertainties
Concentration of Credit Risk
Financial instruments, which potentially subject the Organization to concentrations ofcredit risk, consist principally of cash and cash equivalents, and accounts receivable.
The Foundation maintains its cash with one financial institution. Deposits at this bankare insured by the Federal Deposit Insurance Corporation ("FDIC") up to $250,000. At
December 31, 2022, there were cash balances of $2,142,997 in excess of federally
insured limits at the bank. The Organization performs ongoing credit evaluations of its
customers and maintains allowances, as needed, for potential credit losses. Although
the Organization is directly affected by the financial stability of its customer base,management does not believe significant credit risk exists at December 31, 2022.

Page 12