
H2 2019 Shareholder letter
page 170
Adyen N.V. - 2P6S4AKNWHAC-1741125424-407
Page 6 of 14
We addressed the key audit matters in the context of our audit of the financial statements as a whole,
and in forming our opinion thereon. We do not provide separate opinions on these matters or on
specific elements of the financial statements. Any comment or observation we made on the results of
our procedures should be read in this context.
The valuation of the deferred tax asset was no longer considered a key audit matter. During 2020, no
new (material) tax assets were recognised and no facts and circumstances were identified that
impacted the valuation of the tax assets.
Our audit work and observations
Design and effectiveness of
IT general controls
operating effectiveness of IT general
controls is of significance to the Group. The financial
accounting and reporting of the Group is largely
dependent on the payment platform, since the most
significant line items in the balance sheet (cash and
cash equi
valents, receivables
from financial institutions
and payables to merchants) and the statement of
comprehensive income (revenues and costs incurred
from financial institutions) are recorded on the
payment platform.
In particular, the adequate design and
operating
effectiveness of the payment platform and relevant
IT
general controls are significant for the accurate and
complete processing of occurred transactions.
Based on the above considerations, we considered
IT
general controls as a key audit matter in our audit.
Our audit work included, amongst others,
understanding, evaluating and testing, on a quarterly
basis, the relevant IT general controls, with the
assistance of our IT auditors, to the extent relevant for
our audit. These comprised of the
following key audit
Computer operations ensuring reliability of
IT systems: We tested the design and operating
effectiveness of controls which were implemented
to ensure that back-
up and recovery processes have
been established by the Company and that local
back-ups (per individual datacentre) were made
and stored cross-datacentre. Our test results
demonstrated that production data were replicated
across the individual datacentres. Finally, we
inspected that on an annual basis, the business
continuity plan of the Company was tested for
operating effectiveness.
Access management and segregation of duties over
IT systems: We tested the design and operating
effectiveness of controls, which were implemented
to ensure that logical access to programmes and
data was limited to authorised personnel.
We verified that the Group implemented controls
to ensure, amongst others, the complete and
accurate processing of user rights of joiners,
movers and leavers, the periodic review of user
accounts, the review of database actions and
limitation of administrator accounts throughout
the application, database and network.
Change management procedures for software and
infrastructural changes: We tested the design and
operating effectiveness of relevant controls, which
were implemented to ensure that the development
and maintenance of software was properly
authorised, peer reviewed, approved (both
manually and automated) and documented prior to
Adyen N.V. - 2P6S4AKNWHAC-1741125424-407
Page 7 of 14
Our audit work and observations
implementation in the production environment
and noted no exceptions.
• Cybersecurity: We obtained an understanding of
the Group’s approach to enhancing cyber security
and evaluated the design and effectiveness of
related internal control measures. We focused on
the areas to the extent relevant for the purpose of
our audit of the financial statements.
We furthermore noticed as part of our work performed
that the Group was sufficiently equipped to work
remotely and has been doing so without material
impact on the ability to process payments. We conclude
that we could rely on the IT general controls of the
Group for the purpose of our audit.
Risk of overstatement of revenue
Revenue is disclosed in note 2 to the consolidated
financial statements
The Group’s services operate on the payment platform.
Independent of whether payments are submitted
online, by mobile or through point-of-sale terminals,
there is one integrated platform on which customers are
being served and transactions are being processed.
As such, this key audit matter should be read and
considered in conjunction with the key audit matter on
IT general controls.
The revenues that the Group generated related to
processing fees, settlement fees and fees for other
services in connection with processed payments.
For this purpose, the Company agreed with customers
to charge rates per transaction and by type of activity.
Revenue is recorded on the basis that the Company acts
as a principal for payment processing services it
provides to merchants. Therefore, revenue related to
processing and settlement fees are reported on a gross
basis (as disclosed in note 2 to the consolidated
financial statements).
The Company recognised substantial growth in revenue
over the previous years and has a focus on (medium
term) revenue growth. We deem revenue to be a key
financial indicator on which the performance of
management is measured by stakeholders in the
Company.
Our audit work included, amongst others, an evaluation
of management’s design and operating effectiveness of
controls that mitigate the risk of overstatement of
revenue:
• standing data maintenance covering the accuracy
of customer contracts;
• transaction handling relating to automated
capturing and authorisation of payments;
• automated settlement for matching of bank
statements and collecting and matching refunds
and chargebacks;
• payment pay-out process covering the automated
generating, processing and authorisation of pay-
out batches; and
• automated process over invoicing to customers.
Based on our audit procedures on these activities,
we determined that we could rely on these controls for
the purpose of our audit.
In addition to testing the operating effectiveness of
these controls on revenue recognition and IT general
controls as summarised in the separate key audit
matter on IT general controls, we also performed
substantive procedures:
• On a sample basis, we tested the accuracy of
contractual rates captured in the payment system
by comparing these with signed customer
agreements.
• We performed media scans for ‘bad news’ to
identify potential fictitious revenue.