remediation-recommendations-memo.docx

1021-00008 · Client 1021 · Investigation Analysis

remediation-recommendations-memo.docx DOCUMENT Litigation

19 / 36 ← → ✕

MEMORANDUM

January 3, 2024

FROM: Howard Quinn, Responsible Partner, and Conrad Ashby, Billing Partner White Collar & Investigations Practice Calderwood & Harkness LLP 200 South Biscayne Boulevard, Suite 4400 Miami, FL 33131

TO: Audit Committee of the Board of Directors Verimark Hospitality Group Inc.

Diane Kowalski, Chair Reginald Faulkner, Member Sandra Yeung, Member

RE: Remediation Recommendations — Internal Investigation of Verimark Coastal Resorts LLC

C&H Matter No.: 1021-00008

Right-click to update Table of Contents

I. Introduction and Purpose

This memorandum sets forth Calderwood & Harkness LLP's ("C&H" or "the Firm") recommended remedial measures arising from the independent internal investigation conducted at the direction of the Audit Committee (the "Committee") of the Board of Directors of Verimark Hospitality Group Inc. ("VHG" or the "Company") into financial irregularities identified at Verimark Coastal Resorts LLC ("VCR"), a wholly owned Florida subsidiary of VHG. The purpose of this memorandum is to provide the Committee with a comprehensive, actionable framework for remediation that addresses the root causes of the identified misconduct, strengthens VHG's internal control environment, and positions the Company for successful resolution of the material weakness in internal controls over financial reporting currently outstanding.

The investigation was formally opened on July 24, 2023, following referral from the Committee after the communication of concerns raised during Hargrove, Steen & Aldrich LLP's ("HSA") Q1 2023 interim review. The investigation is being closed upon delivery of the Final Investigation Report, which is scheduled for January 9, 2024. This remediation memorandum is being delivered in advance of the Final Investigation Report to permit the Committee to begin deliberation on the recommended measures and to facilitate prompt implementation.

As detailed in the Final Investigation Report and summarized in Section II below, the investigation identified two distinct but related categories of misconduct at VCR: (1) premature revenue recognition of timeshare-interest deposits, resulting in an aggregate overstatement of approximately $26.4 million across four fiscal quarters (Q3 2022 through Q2 2023); and (2) an expense-reimbursement fraud scheme involving forty-seven (47) fictitious purchase orders totaling approximately $1.83 million directed to three shell entities over an approximately twenty-four-month period (July 2021 through June 2023). These two categories of misconduct, while distinct in nature and mechanism, share common root causes in the control deficiencies at the VCR division level and in the corporate oversight framework applied to VCR's operations.

The recommendations set forth herein are designed to accomplish five principal objectives:

1. Address the material weakness in VCR's internal controls over financial reporting identified by HSA during its Q1 2023 interim review, as communicated to the Committee by HSA engagement partner William Gentry on June 19, 2023.

2. Remediate the specific control deficiencies that permitted the identified misconduct to occur and persist without timely detection.

3. Restore compliance with Sections 302 and 404 of the Sarbanes-Oxley Act of 2002 ("SOX") in connection with VHG's future periodic filings with the U.S. Securities and Exchange Commission (the "SEC" or the "Commission").

4. Establish a governance and oversight framework that significantly reduces the risk of similar misconduct occurring at VCR or at any other VHG operating division in the future.

5. Demonstrate to regulators, shareholders, and other stakeholders that VHG has taken prompt, comprehensive, and good-faith remedial action in response to the identified irregularities.

These recommendations supplement the personnel actions already taken by the Company in connection with the investigation. Specifically, on December 18, 2023, VHG terminated for cause Garrett W. Daskine, Division President of VCR, and Nicole Prescott, Vice President of Finance of VCR, following the completion of the evidentiary phase of the investigation. On December 20, 2023, VHG terminated without cause Ryan Mateo Serrano, Controller of VCR, pursuant to the terms of the cooperation agreement entered into between Serrano and VHG on November 15, 2023. The cooperation agreement, which was negotiated with the involvement of Serrano's personal counsel, provided for Serrano's continued employment through the completion of his cooperation obligations in exchange for a non-cause separation, and its terms are addressed in a separate memorandum to the Committee dated November 17, 2023.

The recommendations contained herein were developed by C&H with significant input from Crestline Forensic Advisory LLC ("Crestline"), the forensic accounting firm engaged by C&H at the Committee's direction to assist with the investigation (engagement number CFA-VHG-2023-0089; engagement partner Douglas Reinhardt, CPA, CFF; senior manager Priya Venkatesh, CPA). Crestline's forensic analysis of the revenue-recognition irregularities and fictitious vendor scheme informed the specific control recommendations set forth in Sections III, IV, and V of this memorandum. Crestline has reviewed and concurs with the remediation framework described herein.

Finally, we note that VHG's outside securities counsel, Westlake Burris & Holt LLP ("WBH"), specifically Irene Castellanos, should be consulted regarding the disclosure of the remediation steps described in this memorandum in connection with the preparation and filing of the amended Form 10-K for fiscal year 2022 and the amended Forms 10-Q for Q1 2023 and Q2 2023. Disclosure considerations also arise in connection with the SEC Division of Enforcement's preliminary inquiry into VHG (File No. HO-14237), which remains pending as of the date of this memorandum. The Committee should coordinate with WBH to ensure that any public disclosure of remediation measures is consistent with VHG's legal strategy and disclosure obligations.

II. Executive Summary of Findings Giving Rise to Remediation Needs

Before setting forth our specific recommendations, we provide below a summary of the principal investigative findings that inform the remediation framework. A full discussion of the evidence, witness interviews, and analytical work supporting these findings is contained in the Final Investigation Report to be delivered on January 9, 2024. This summary is intended to provide sufficient context for the Committee's evaluation of the recommended remedial measures.

A. Revenue-Recognition Irregularities

The investigation determined that VCR systematically engaged in premature revenue recognition of timeshare-interest purchase deposits over a period spanning four fiscal quarters, from Q3 2022 (quarter ending September 30, 2022) through Q2 2023 (quarter ending June 30, 2023). The scheme involved the booking of timeshare-interest purchase deposits as completed-sale revenue upon the signing of purchase agreements, rather than deferring recognition until the expiration of the statutory ten-calendar-day rescission period mandated by Florida Statute § 721.10. Under that provision, purchasers of timeshare interests in the State of Florida have an unconditional right to cancel the purchase contract within ten days of execution, and no transfer of the timeshare interest is effective until that period has lapsed without cancellation.

During the investigated period, purchasers who exercised their rescission rights had their corresponding revenue reversals systematically deferred to the following fiscal quarter, rather than being recorded in the quarter in which the rescission occurred. This practice created a persistent overstatement of revenue that rolled forward from quarter to quarter, with the magnitude of the overstatement growing as timeshare sales activity increased at VCR's two principal timeshare properties during the period.

The aggregate revenue overstatement across the four affected quarters was approximately $26.4 million, broken down as follows:

With respect to FY 2022 specifically, the aggregate overstatement was $10.8 million (the sum of the Q3 and Q4 FY 2022 overstatements of $4.7 million and $6.1 million, respectively). At VHG's effective tax rate of 24.3% for FY 2022, this produced an after-tax net income overstatement of approximately $8.17 million. VHG reported FY 2022 net income of $142.3 million; accordingly, the after-tax income overstatement represents approximately 5.74% of reported net income — a level that is material by any commonly applied quantitative benchmark and that is particularly significant in light of the qualitative considerations attendant to intentional misconduct.

The revenue-recognition irregularities were concentrated at two VCR timeshare properties:

• Coral Dune Resort & Residences, located at 14200 Emerald Coast Parkway, Destin, Florida 32541 (Phase III timeshare units); and

• Palmetto Bluff Club, located at 3950 Longboat Key Drive, Sarasota, Florida 34228 (Phase II timeshare units).

Both properties experienced robust timeshare sales activity during the investigated period, driven in part by VCR's aggressive marketing campaigns and favorable market conditions in the Florida resort real estate sector. VCR's timeshare rescission rate during the investigated period was approximately 14.3%, compared to an industry average of approximately 11%, a differential that amplified the revenue-recognition distortion created by the premature booking practice. The higher-than-average rescission rate meant that a larger proportion of prematurely recognized revenue ultimately required reversal, and the systematic deferral of those reversals to subsequent quarters compounded the overstatement effect.

VCR reported FY 2022 revenue of approximately $438.7 million, representing approximately 23.5% of VHG's consolidated revenue of $1.87 billion. VCR is thus a material operating subsidiary, and the revenue-recognition irregularities at VCR had a direct and material impact on VHG's consolidated financial statements.

The investigation determined that the premature revenue-recognition scheme was directed by Division President Garrett W. Daskine and implemented at his instruction by Vice President of Finance Nicole Prescott. The evidence indicates that Daskine was motivated by a desire to meet or exceed quarterly revenue targets that were linked to his performance-based compensation, including annual bonuses and long-term equity incentive awards. Prescott implemented the scheme by overriding standard revenue-recognition procedures in VCR's accounting system and instructing subordinate accounting staff to record timeshare deposits as revenue upon contract execution without regard to the rescission-period requirement. The evidence supporting these findings, including documentary evidence and witness testimony, is set forth in detail in the Final Investigation Report.

B. Expense-Reimbursement Irregularities (Fictitious Vendor Scheme)

Concurrent with the revenue-recognition irregularities, the investigation identified a separate scheme involving the creation of fictitious purchase orders and the payment of fraudulent invoices to three shell entities that purported to perform capital-improvement work at VCR properties but in fact performed no work of any kind. This scheme was orchestrated by VCR Controller Ryan Mateo Serrano, who created the fictitious purchase orders in VCR's procurement system, with the knowledge and participation of Division President Daskine and VP of Finance Prescott, both of whom were beneficial owners of one or more of the shell entities.

The three shell entities involved in the scheme were as follows:

1. Gulf Standard Contracting LLC ("GSC")

GSC was formed as a Florida limited liability company on March 12, 2021. The registered agent listed in the Florida Secretary of State filings was Ryan Mateo Serrano. The beneficial owner of GSC was Garrett W. Daskine, who held his interest through a nominee arrangement designed to obscure his ownership. GSC submitted nineteen (19) invoices to VCR over the course of the scheme, totaling $812,400 in fraudulent payments.

2. Clearwater Design Collective Inc. ("CDC")

CDC was formed as a Florida corporation on June 4, 2021. The registered agent listed in the Florida Secretary of State filings was Ryan Mateo Serrano. The sole shareholder of CDC was Nicole Prescott. CDC submitted sixteen (16) invoices to VCR, totaling $587,600 in fraudulent payments.

3. Suncoast Property Services LLC ("SPS")

SPS was formed as a Florida limited liability company on November 18, 2021. The registered agent listed in the Florida Secretary of State filings was Panhandle Agent Services Inc., a commercial registered agent service based in Tallahassee, Florida. The sole member of SPS was Garrett W. Daskine, who in this instance held his interest directly. SPS submitted twelve (12) invoices to VCR, totaling $430,000 in fraudulent payments.

In total, the three shell entities submitted forty-seven (47) fictitious invoices to VCR, resulting in total improper payments of $1,830,000 ($1.83 million). The invoices purported to reflect charges for capital-improvement work at VCR properties, including lobby renovations, exterior painting, landscaping, and HVAC upgrades. No such work was actually performed by any of the three entities. The largest single fraudulent invoice was Invoice No. GSC-2023-007, dated February 14, 2023, in the amount of $94,500, purportedly for "lobby renovation materials — Coral Dune Phase III."

Crestline's forensic analysis, which included a detailed tracing of funds through the bank accounts of GSC, CDC, and SPS, determined that the fraudulent payments were used to fund personal expenditures of Daskine and Prescott, including but not limited to: residential renovation work at Daskine's personal residence located at 312 Harbor View Lane, Destin, Florida 32541; boat-slip fees at a marina facility; luxury-goods purchases at various retail establishments; and personal credit-card payments. The details of the fund-tracing analysis are set forth in Crestline's forensic accounting report, which is appended to the Final Investigation Report.

C. Summary of Control Deficiencies

The misconduct described above was enabled by a series of specific internal control failures within VCR and within VHG's corporate oversight framework. Based on our investigation, in consultation with Crestline, we have identified the following principal control deficiencies:

(i) Lack of Independent Verification of Vendor Legitimacy. VCR's vendor-onboarding process did not include independent verification of vendor legal existence, physical business address, or beneficial ownership. New vendors could be added to the approved vendor list based solely on information provided by VCR division personnel, with no independent corroboration. This deficiency permitted the three shell entities to be onboarded as VCR vendors without detection of their fraudulent nature.

(ii) Insufficient Segregation of Duties in Purchase-Order Creation and Approval. VCR's procurement system permitted the same individual — in this case, Controller Serrano — to both create and approve purchase orders below certain dollar thresholds. This lack of segregation of duties eliminated a critical check on the legitimacy of purchase orders and vendor payments, and allowed Serrano to generate and approve fictitious POs without independent review.

(iii) Absence of Real-Time Reconciliation of Timeshare Deposits Against Rescission-Period Status. VCR's revenue-recognition procedures did not include any systematic mechanism for tracking the status of timeshare purchase contracts relative to the ten-day rescission period. There was no automated hold on revenue recognition during the rescission window, and no reconciliation process to ensure that revenue was not recognized before the rescission period had expired. This deficiency allowed the premature revenue-recognition scheme to be implemented and to persist across multiple quarters.

(iv) Inadequate Review of Capital-Improvement Budgets at the Corporate Level. VHG corporate finance did not perform meaningful oversight of VCR's capital-improvement spending. Annual capital budgets were prepared and approved at the division level without substantive corporate review, and there was no mechanism for corporate-level variance analysis or verification that budgeted capital projects were actually performed. This deficiency allowed the fictitious vendor scheme to be concealed within VCR's capital-improvement spending without triggering corporate scrutiny.

(v) Over-Reliance on Division-Level Financial Self-Reporting. VHG's financial reporting framework relied extensively on division-level management to prepare and certify financial results that were then incorporated into consolidated financial statements with limited independent verification at the corporate level. This over-reliance on the accuracy and integrity of division-level reporting created an environment in which division management could manipulate financial results with a low risk of detection.

(vi) Insufficient Whistleblower Channels Accessible to Division-Level Employees. While VHG maintained a corporate whistleblower hotline, the investigation found that VCR division-level employees were largely unaware of its existence, and those who were aware perceived it as inadequate for reporting concerns about division management. Several VCR employees interviewed during the investigation stated that they had observed conduct that raised concerns but did not report those concerns because they were uncertain how to do so or feared retaliation from division management.

These control deficiencies, taken together, constitute a material weakness in internal controls over financial reporting, as communicated by HSA engagement partner William Gentry on June 19, 2023. The material weakness was publicly disclosed in VHG's Form 8-K filed with the SEC on August 14, 2023, under Item 4.02 (Non-Reliance on Previously Issued Financial Statements or a Related Audit Report or Completed Interim Review). The remediation recommendations set forth in the following sections are designed to address each of the identified control deficiencies comprehensively.

III. Recommendations: Revenue-Recognition Controls

The revenue-recognition irregularities at VCR exploited the absence of adequate controls governing the timing of revenue recognition for timeshare-interest sales. The following recommendations are designed to establish a robust control framework that prevents premature revenue recognition, ensures compliance with applicable accounting standards and Florida statutory requirements, and provides for independent verification of VCR revenue entries before their inclusion in VHG's consolidated financial statements.

A. Mandatory Reconciliation of Timeshare Deposits Against Rescission-Period Expiration

We recommend that VHG implement a system-enforced hold on the recognition of revenue for all timeshare-interest purchase deposits until the expiration of the ten-calendar-day rescission period mandated by Florida Statute § 721.10. This hold should be embedded as a hard control within VCR's enterprise resource planning ("ERP") system, such that it cannot be overridden by division-level personnel without generating an exception alert that is routed to VHG corporate accounting for review and approval.

Specifically, under the recommended control framework, revenue from timeshare-interest sales may be recognized only after the following conditions have been satisfied:

(i) The ten-calendar-day rescission period prescribed by Florida Statute § 721.10 has expired without the purchaser exercising rescission rights;

(ii) An independent reconciliation has been performed by personnel outside of VCR division management confirming that no rescission notice has been received with respect to the subject purchase agreement; and

(iii) The reconciliation has been documented and approved in the ERP system by an authorized VHG corporate accounting representative.

To support the reconciliation process, VHG should require daily automated reporting of all timeshare purchase agreements executed at VCR properties. Each report should include, at a minimum, the following data elements: purchaser name, agreement execution date, property and unit identification, contract price, deposit amount received, scheduled rescission-period maturation date (calculated as ten calendar days following the execution date), and current rescission status (pending, expired without rescission, or rescinded). These daily reports should be generated automatically from VCR's sales management system and integrated with VCR's ERP system to ensure consistency and prevent manual manipulation.

We further recommend that the reconciliation responsibility for all timeshare revenue entries in excess of defined thresholds be assigned to VHG corporate accounting personnel rather than VCR division personnel. Based on our review of VCR's timeshare sales patterns during the investigated period, we suggest that the threshold be set at $50,000 per individual transaction, with all transactions above that amount requiring corporate-level reconciliation and approval before revenue recognition. For transactions below the threshold, division-level reconciliation may be performed, subject to sample-based verification by VHG corporate accounting on a quarterly basis as described in Section III.C below.

B. ASC 606 Compliance Procedures — Timeshare-Specific Controls

The investigation revealed that VCR did not maintain a written revenue-recognition policy that specifically addressed the unique characteristics of timeshare-interest sales under Accounting Standards Codification Topic 606 (Revenue from Contracts with Customers) ("ASC 606"). The absence of such a policy contributed to the environment in which premature revenue recognition could occur. We recommend that VHG develop and implement a comprehensive written revenue-recognition policy that specifically addresses timeshare-interest sales and incorporates the five-step revenue-recognition model prescribed by ASC 606, with detailed mapping to VCR's timeshare contract structures.

The policy should address, at a minimum, the following elements:

Step 1 — Identify the Contract with a Customer. The policy should specify the criteria for determining when a valid contract exists for a timeshare-interest sale, including the requirement that the rescission period must have expired without cancellation before the contract is considered to have met the enforceability criterion under ASC 606-10-25-1.

Step 2 — Identify the Performance Obligations in the Contract. The policy should identify and distinguish the various performance obligations that may be present in a timeshare-interest sale, including the transfer of the timeshare interest itself, any associated amenities or services, and any ongoing maintenance or management obligations.

Step 3 — Determine the Transaction Price. Critically, the policy should address the rescission right as a variable-consideration element under ASC 606-10-32-7. The ten-day statutory rescission period creates a "right of return" that introduces variability into the transaction price. The policy should require estimation of expected rescissions based on historical rescission rates, with the constraint that revenue should be recognized only to the extent that it is probable that a significant reversal will not occur. Given VCR's observed rescission rate of approximately 14.3% during the investigated period — which exceeds the industry average of approximately 11% — the policy should require conservative estimation of the rescission reserve.

Step 4 — Allocate the Transaction Price to the Performance Obligations. The policy should set forth the methodology for allocating the transaction price among the identified performance obligations on a relative standalone selling-price basis.

Step 5 — Recognize Revenue When (or As) the Entity Satisfies a Performance Obligation. The policy should specify the point at which each performance obligation is satisfied, with particular emphasis on the requirement that the transfer of control of the timeshare interest does not occur until the rescission period has expired.

In addition to the policy itself, we recommend that VHG require quarterly review of the rescission-rate assumptions used in the variable-consideration estimation by VHG's corporate controller, with formal sign-off by the Chief Financial Officer, Thomas Rhett Griffith. This quarterly review should include comparison of actual rescission rates to the estimates used in the prior quarter, with an analysis of any significant variances and adjustment of future estimates as warranted.

We further recommend that VCR's revenue entries be subject to independent verification by VHG's corporate finance team before inclusion in VHG's consolidated financial statements. This verification should include, at a minimum, a review of the mathematical accuracy of the revenue entries, confirmation that the rescission-period hold has been applied, and a reasonableness check against the approved rescission-rate estimates. Any revenue entries that do not satisfy these verification criteria should be excluded from the consolidated financial statements pending resolution.

C. Quarter-End Close Procedures

To provide an additional layer of assurance at each quarter-end, we recommend the institution of a VCR-specific sub-certification process. Under this process, the VCR division finance lead (the successor to Nicole Prescott, once appointed) should be required to provide a written certification at each quarter-end affirming that all timeshare revenue recognized during the quarter has been reconciled against rescission-period expirations, that all rescission reversals have been properly recorded in the quarter in which the rescission occurred, and that no revenue has been recognized with respect to any timeshare purchase agreement for which the rescission period had not expired as of the quarter-end date. This sub-certification should be provided to the VHG corporate controller and retained as part of VHG's SOX documentation.

In addition to the sub-certification, VHG corporate finance should perform a sample-based substantive test of VCR timeshare revenue entries at each quarter-end. We recommend a minimum sample size of twenty-five percent (25%) of transactions by dollar volume, selected on a risk-weighted basis with particular focus on transactions executed in the final ten days of the quarter (where rescission periods would straddle the quarter-end date). For each sampled transaction, corporate finance should independently confirm the contract execution date, rescission-period expiration date, absence of any rescission notice, and the accuracy of the revenue amount recognized.

To address the specific issue of rescission periods that straddle quarter-end dates — which was a key mechanism through which the overstatement was generated — we recommend the establishment of a "pending revenue" suspense account. All timeshare purchase deposits for which the rescission period has not expired as of the last day of a fiscal quarter should be recorded in this suspense account rather than in revenue. Revenue from these deposits should be recognized only in the subsequent quarter, after the rescission period has expired and the reconciliation described in Section III.A has been completed. This approach may result in a modest timing shift of revenue recognition relative to current practice, but it will ensure that VCR's reported quarterly revenue is free of the rescission-period distortion that characterized the investigated period.

D. Enhanced HSA Coordination

Finally, with respect to revenue-recognition controls, we recommend that VHG's engagement with its independent auditor, HSA, be expanded to include enhanced interim-review procedures specifically focused on VCR timeshare revenue. Given the materiality of VCR's timeshare revenue to VHG's consolidated results and the history of irregularities at VCR, we believe it is appropriate for HSA to perform monthly analytical procedures during quarters with significant timeshare sales activity. These analytical procedures should include trend analysis of VCR timeshare revenue, comparison of recognized revenue to contract execution and rescission data, and review of the pending-revenue suspense account balance.

In addition, we recommend that VHG request HSA to perform targeted testing of VCR revenue-recognition entries as part of each quarterly review engagement. This targeted testing should include, at a minimum, independent confirmation of a sample of timeshare contracts to verify execution dates and rescission-period status, and recomputation of the variable-consideration adjustment based on actual rescission data. The scope and timing of HSA's enhanced procedures should be coordinated with HSA engagement partner William Gentry to ensure that they are integrated with HSA's overall audit plan and do not create inefficiencies or conflicts with the annual audit engagement.

IV. Recommendations: Vendor Management and Purchase-Order Authorization Controls

The fictitious vendor scheme at VCR was facilitated by fundamental weaknesses in VCR's vendor-management processes and purchase-order authorization controls. The following recommendations are designed to eliminate the conditions that allowed shell entities to be onboarded as approved vendors, fictitious purchase orders to be created and approved by the same individual, and fraudulent payments to be disbursed without adequate verification.

A. Vendor Approval and Onboarding Reforms

We recommend that VHG implement a centralized vendor-approval process managed at the VHG corporate level for all new vendors engaged by any VHG operating division, including VCR. Under the current decentralized framework, division-level management has the authority to onboard new vendors and add them to the approved vendor list without corporate involvement. This decentralized approach was the primary mechanism through which the three shell entities (GSC, CDC, and SPS) were introduced into VCR's vendor ecosystem. A centralized approval process will provide an independent check on vendor legitimacy and will prevent division-level personnel from onboarding vendors in which they have undisclosed financial interests.

Under the recommended centralized process, the following due-diligence steps should be completed and documented for all new vendors before they are added to the approved vendor master list:

(i) Verification of Legal Existence. VHG corporate procurement should independently verify the vendor's legal existence through review of Secretary of State filings in the state of formation. This verification should confirm the vendor's formation date, current good-standing status, registered agent, and publicly available ownership information.

(ii) Independent Confirmation of Physical Business Address. VHG corporate procurement should independently confirm that the vendor maintains a physical business address (not merely a mail-drop or virtual office) through commercially available address-verification services or, where warranted, through physical inspection.

(iii) Verification of No Employee Financial Interest. VHG corporate procurement should verify that no VHG employee, officer, or director has a direct or indirect ownership or financial interest in the vendor. This verification should include a comparison of vendor ownership information against VHG's employee, officer, and director roster, as well as review of the conflict-of-interest certifications described below.

(iv) Confirmation of Valid Business Licenses and Insurance. VHG corporate procurement should confirm that the vendor holds all business licenses required by applicable law and maintains appropriate insurance coverage, including general liability and workers' compensation insurance (for vendors providing on-site services).

(v) Reference Checks. VHG corporate procurement should obtain and verify references from at least two non-affiliated parties who have engaged the vendor for comparable services within the preceding twenty-four months. References provided by VHG employees should not be accepted.

In addition to the onboarding due diligence described above, we recommend that VHG establish a "related party" disclosure requirement applicable to all VHG employees involved in the vendor-selection or payment-approval process. Specifically, every such employee should be required to certify annually — and on an ad hoc basis when engaging a new vendor or approving a payment to an existing vendor — that they have no undisclosed financial interest in any vendor that does business with VHG or any subsidiary. This certification should be made under penalty of termination for cause and should require disclosure of any direct or indirect ownership interest, any consulting or employment relationship, any family relationship with a vendor owner or principal, and any other financial interest that could create a conflict of interest. The annual certifications should be collected by VHG's General Counsel and maintained as part of VHG's compliance records.

VHG should maintain a centralized approved-vendor master list, accessible to all divisions, with periodic re-verification of all listed vendors on at least an annual basis. The re-verification should include confirmation of continued legal existence, current good-standing status, and the continued absence of any VHG employee financial interest. Vendors that fail re-verification should be suspended from the approved list pending resolution.

Finally, we recommend that VHG implement a flag for vendors with formation dates within twelve (12) months of their first invoice to VHG or any subsidiary. Such recently formed vendors present an elevated risk of being shell entities created for fraudulent purposes, as illustrated by the GSC, CDC, and SPS entities in this case (each of which was formed within months of its first invoice to VCR). Vendors flagged under this criterion should be subject to enhanced due diligence, including a site visit by VHG internal audit or corporate procurement and more extensive reference verification.

B. Purchase-Order Authorization and Segregation of Duties

The investigation revealed that VCR's procurement system permitted a single individual to both create and approve purchase orders below certain dollar thresholds, a deficiency that was directly exploited by Controller Serrano to generate and approve the forty-seven fictitious purchase orders underlying the vendor fraud scheme. We recommend that VHG eliminate this capability entirely and implement mandatory segregation of duties such that the purchase-order creator, the purchase-order approver, and the goods-receipt confirmer are always three distinct individuals for every purchase order regardless of dollar amount.

In addition to the segregation-of-duties requirement, we recommend the implementation of tiered approval authorities, as follows:

These tiered approval thresholds are designed to ensure that higher-value purchase orders receive corporate-level scrutiny while avoiding an undue administrative burden on routine low-value transactions. We note that under the proposed thresholds, the largest single fictitious invoice in the VCR scheme — Invoice No. GSC-2023-007 in the amount of $94,500 — would have required the approval of VHG CFO Thomas Rhett Griffith and would therefore have been subjected to a level of review that would have detected its fraudulent nature. More broadly, twenty-three of the forty-seven fictitious invoices exceeded the $25,000 threshold and would have required corporate-level review, while four exceeded the $75,000 threshold and would have required CFO approval.

These approval workflows must be system-enforced within VCR's ERP and procurement system. We recommend that VHG eliminate all manual or paper-based purchase-order processes at VCR and require that all purchase orders be created, routed, and approved exclusively through the electronic procurement workflow. The system should be configured to prevent the advancement of a purchase order to the next approval stage without the required electronic approval from the designated approver, and to prevent any single user from acting in more than one approval role for a given transaction.

For capital-improvement purchase orders specifically — the category of expenditure under which the fictitious invoices were disguised — we recommend an additional control requiring photographic and documentary evidence of work completion before payment release. For all capital-improvement purchase orders exceeding $10,000, the goods-receipt confirmation should include, at a minimum: (a) before-and-after photographs of the work site; (b) an inspection report prepared by a VCR facilities management representative (other than the PO creator or approver); (c) any required lien waivers from the vendor; and (d) any applicable building permits or inspection certificates. This documentation should be uploaded to the ERP system and retained as part of the transaction record.

C. Capital-Improvement Budget Oversight

The fictitious vendor scheme was concealed in part because VHG corporate finance did not exercise meaningful oversight over VCR's capital-improvement spending. We recommend that VHG corporate finance be required to approve the annual capital-improvement budget for each VCR property — including Coral Dune Resort & Residences and Palmetto Bluff Club — and to perform quarterly variance analysis comparing actual capital expenditures to the approved budget.

Budget variances exceeding ten percent (10%) of the budgeted amount for any individual project or $50,000 in absolute terms, whichever threshold is lower, should be individually explained by VCR division management and approved by the VHG CFO before additional expenditures are authorized. This variance-analysis requirement will provide early detection of anomalous spending patterns that may indicate fraudulent activity or waste.

In addition, we recommend the implementation of a random audit program under which VHG internal audit (or the co-sourced internal audit provider, as discussed in Section V.A below) conducts unannounced site visits to VCR properties to verify that capital-improvement work purportedly performed by third-party vendors has in fact been completed as described. The frequency of these site visits should be determined based on a risk assessment, but we recommend a minimum of two unannounced visits per property per year during the initial remediation period.

D. Accounts-Payable Controls

To further strengthen the payment process and reduce the risk of fraudulent disbursements, we recommend the following enhancements to VCR's accounts-payable controls:

Three-Way Matching. VHG should require three-way matching — matching of the purchase order, the goods-receipt confirmation, and the vendor invoice — for all payments exceeding $5,000 before any disbursement is processed. The matching should be performed within the ERP system, and any discrepancies among the three documents should generate a hold on payment pending investigation and resolution. During the VCR vendor fraud scheme, invoices were paid based solely on PO approval without any independent confirmation of goods receipt, a gap that this control is designed to close.

Duplicate-Payment Detection. VHG should implement duplicate-payment detection algorithms within the accounts-payable system. These algorithms should be configured to flag invoices that share common characteristics with previously processed invoices, including matching or similar invoice numbers, identical dollar amounts, or identical vendor-and-date combinations. Flagged transactions should be reviewed by a designated AP supervisor before payment is released.

Vendor Bank-Account Change Verification. VHG should require that all changes to vendor bank-account information be independently verified through a call-back procedure to a confirmed vendor contact. The call-back must be made to a telephone number independently obtained from the vendor's verified business records — not to a number provided by the party requesting the change. This control is designed to prevent diversion of payments to fraudulent bank accounts, a common scheme vector that, while not employed in the VCR fraud, represents a foreseeable risk.

V. Recommendations: Corporate Governance and Oversight Enhancements

Beyond the specific transaction-level controls described in Sections III and IV, the investigation findings point to broader deficiencies in VHG's corporate governance and oversight framework that contributed to the environment in which the misconduct could occur and persist. The following recommendations address these structural issues.

A. Internal Audit Function

At the time the misconduct occurred, VHG did not maintain a dedicated internal audit function. Internal audit responsibilities were performed on an ad hoc basis by VHG corporate finance personnel, with no formal internal audit charter, no independent reporting line to the Audit Committee, and no systematic risk-based audit plan. This absence of a formal internal audit function is a significant gap in VHG's governance framework, particularly for a public company of VHG's size and complexity (approximately $1.87 billion in consolidated revenue and multiple operating divisions across multiple states).

We recommend the establishment of a dedicated VHG internal audit function, either through the hiring of an in-house internal audit team or through the engagement of a co-sourced internal audit provider. The internal audit function should report directly to the Audit Committee, with administrative reporting to the VHG CFO for day-to-day operational matters. The Audit Committee should approve the internal audit charter, the annual audit plan, and the internal audit budget, and should have the authority to direct the internal audit function to perform special projects or investigations as warranted.

The internal audit plan should be developed on a risk-based methodology and should include, at a minimum, annual testing of the following areas:

(i) Revenue-recognition controls, with particular emphasis on timeshare revenue at VCR and any other VHG division engaged in timeshare sales;

(ii) Vendor-management controls, including compliance with the centralized vendor-approval process and the related-party disclosure requirements;

(iii) Expense-reimbursement controls, including purchase-order authorization compliance and three-way matching adherence; and

(iv) Related-party transaction disclosures, including verification of the accuracy and completeness of annual conflict-of-interest certifications.

Given the irregularities identified at VCR, we recommend that VCR be designated as a high-risk audit area and receive enhanced internal audit coverage during at least the first two annual audit cycles following implementation of the remediation program.

B. SOX Section 404 Remediation — Material Weakness

The material weakness in VCR's internal controls over financial reporting, as identified and communicated by HSA on June 19, 2023, must be remediated before VHG can issue an unqualified management assessment of internal controls in its next annual report. The remediation of this material weakness is a critical priority for VHG and should be treated as such by management and the Board.

We recommend that VHG implement all of the revenue-recognition and vendor-management controls described in Sections III and IV of this memorandum as part of a comprehensive material-weakness remediation plan. The remediation plan should be documented in writing, with each control mapped to the specific control deficiency it is designed to address, and with a clear timeline for implementation, testing, and evaluation.

Once the new and enhanced controls are implemented, VHG should document the design of each control and test its operating effectiveness over a sufficient period to support a conclusion that the control is operating as designed. Consistent with SEC Staff guidance and PCAOB Auditing Standard No. 2201, we recommend that VHG demonstrate operating effectiveness over a period of at least two full fiscal quarters before representing that the material weakness has been remediated. The specific duration required to support a remediation conclusion should be coordinated with HSA (engagement partner William Gentry) to ensure alignment with HSA's assessment methodology.

We recommend that VHG coordinate proactively with HSA to confirm that the remediation plan described herein is sufficient in scope and design to support a conclusion that the material weakness has been remediated in time for the FY 2023 annual audit. Early engagement with HSA on the remediation plan will reduce the risk of a disagreement at year-end regarding the sufficiency of remediation and will allow VHG to make any necessary adjustments to the plan in a timely manner.

Additionally, we recommend that VHG's Chief Executive Officer, Margaret Calder, and Chief Financial Officer, Thomas Rhett Griffith, coordinate with VHG General Counsel Patricia Navarro to ensure that the SOX Section 302 certifications provided in connection with future periodic filings accurately reflect the current status of the remediation effort. Until the material weakness has been fully remediated, the Section 302 certifications should include appropriate disclosure of the material weakness and the ongoing remediation program, consistent with the requirements of Items 307 and 308 of Regulation S-K.

C. Audit Committee Reporting Enhancements

The Committee's ability to exercise effective oversight depends on the quality and timeliness of information it receives from management, internal audit, and the external auditor. We recommend the following enhancements to the Committee's reporting framework:

(i) Quarterly CFO Reports. VHG CFO Thomas Rhett Griffith should provide quarterly written reports to the Committee on: (a) the status of remediation efforts, including progress against the implementation timeline set forth in Section X below; (b) the results of any internal audit testing of VCR controls performed during the quarter; and (c) any new potential control deficiencies identified at VCR or any other VHG division. These reports should be provided in advance of regularly scheduled Committee meetings to allow for adequate review and preparation of questions.

(ii) Semi-Annual VCR Division Presentations. The Committee should receive a direct presentation from the VCR division finance lead (the successor to Nicole Prescott, once appointed) at least semi-annually regarding VCR's financial results and the state of internal controls at VCR. This direct engagement between the Committee and VCR division finance personnel will provide the Committee with an independent perspective on VCR operations and will reduce the risk of the information asymmetry that contributed to the failure to detect the misconduct.

(iii) Quarterly Executive Sessions with HSA. The Committee should engage in periodic executive sessions with HSA's engagement team, without VHG management present, at least quarterly. These sessions will provide the Committee with an opportunity to receive candid input from the external auditor on the progress of remediation, any concerns regarding the control environment, and any other matters that HSA may be reluctant to raise in the presence of management.

D. Enhanced Whistleblower and Ethics Reporting Procedures

The investigation revealed that VCR division-level employees had limited awareness of and access to VHG's whistleblower reporting mechanisms, and that those who were aware of the mechanisms did not view them as effective or safe channels for reporting concerns about division management. Strengthening these channels is essential to creating an environment in which potential misconduct is detected and reported promptly.

We recommend the following enhancements to VHG's whistleblower and ethics reporting infrastructure:

(i) Upgraded Whistleblower Hotline. VHG should upgrade its existing whistleblower hotline to ensure anonymity and accessibility for all employees, including VCR field personnel. The upgraded system should include a toll-free telephone number, a web-based reporting portal, and a mobile application, and should be available in English and Spanish (reflecting the demographics of VCR's workforce). Reports should be received and managed by a third-party hotline provider independent of VHG management to ensure anonymity.

(ii) Dedicated Ethics Reporting Channel. VHG should implement a dedicated ethics reporting channel that is separate from VCR division management and that routes reports directly to VHG's General Counsel and the Audit Committee Chair. This channel should be clearly distinguished from routine operational complaint mechanisms and should be specifically identified as a pathway for reporting suspected fraud, financial irregularities, and violations of VHG's Code of Conduct.

(iii) Publicization and Training. VHG should publicize the whistleblower and ethics reporting mechanisms through mandatory annual training for all employees, including VCR field personnel. In addition, visible signage describing the reporting mechanisms should be posted at all VCR properties, including in employee break rooms, administrative offices, and common areas.

(iv) Non-Retaliation Policy. VHG should establish a formal non-retaliation policy that provides specific protections for employees who report suspected misconduct in good faith. The policy should include specific enforcement mechanisms, such as disciplinary action against any employee found to have retaliated against a whistleblower, and should be subject to periodic auditing to ensure that complaint outcomes do not reflect patterns of retaliation.

VI. Recommendations: Compliance Training and Tone at the Top

The effectiveness of the controls and governance enhancements described in the preceding sections will depend significantly on the knowledge, awareness, and ethical commitment of VHG's personnel. The following recommendations address the human-capital dimension of the remediation program.

A. Mandatory Compliance Training

We recommend that VHG require all finance, accounting, and management personnel at both the corporate and division levels, including all VCR employees in these categories, to complete mandatory annual compliance training covering the following topics:

• Revenue-Recognition Principles Under ASC 606. This training module should address the five-step revenue-recognition model with specific application to timeshare-interest sales, including the treatment of the Florida Statute § 721.10 rescission period as a variable-consideration element. The module should incorporate case studies drawn from the VCR investigation (appropriately anonymized to protect privileged information) to illustrate the consequences of premature revenue recognition.

• Vendor-Management and Conflict-of-Interest Policies. This module should cover VHG's centralized vendor-approval process, the related-party disclosure requirements, and the prohibition on employee financial interests in VHG vendors. The module should emphasize the due-diligence steps required for vendor onboarding and the consequences of circumventing these procedures.

• Expense-Reimbursement Policies and the Prohibition on Fictitious or Inflated Claims. This module should cover VHG's purchase-order authorization procedures, the segregation-of-duties requirements, and the three-way matching controls. The module should clearly communicate that the creation of fictitious purchase orders or invoices constitutes fraud and will result in termination, civil liability, and potential criminal prosecution.

• SOX Sections 302 and 404 Obligations. This module should educate relevant personnel on the requirements of SOX Sections 302 and 404, including the personal liability of certifying officers, the definition and consequences of material weaknesses in internal controls, and the role of each employee in supporting the accuracy of VHG's financial reporting.

• Federal Securities Law Anti-Fraud Provisions. This module should provide an overview of the anti-fraud provisions of the Securities Exchange Act of 1934 (including Section 10(b) and Rule 10b-5), the penalties for securities fraud, and the role of the SEC in enforcement. This module should be designed to reinforce the seriousness of financial-reporting integrity in the context of a public company.

• Whistleblower Protections and Reporting Channels. This module should educate all employees on the available whistleblower and ethics reporting channels, the procedures for making a report, and the non-retaliation protections available to employees who report suspected misconduct in good faith.

Training should be completed within ninety (90) days of the implementation date for all current employees and within thirty (30) days of hire for new employees. Refresher training should be required annually thereafter. Completion of training should be electronically tracked, and compliance rates should be reported to the Audit Committee on a quarterly basis. Failure to complete required training within the specified timeframe should result in escalating consequences, up to and including suspension of the employee's system access and, if necessary, disciplinary action.

B. Code of Conduct and Ethics Policy Updates

We recommend that VHG revise its Code of Conduct and Ethics Policy (the "Code") to specifically address the types of misconduct identified in this investigation. The current Code, which was last revised in 2019, does not contain provisions that specifically address related-party vendor schemes, premature revenue recognition, or other forms of financial-reporting fraud. The revised Code should include clear, specific prohibitions on these types of conduct, with examples drawn from the investigation (appropriately anonymized), and should set forth the disciplinary consequences for violations.

All employees at the vice-president level and above should be required to certify their compliance with the Code on an annual basis. This certification should be a written acknowledgment that the employee has read and understood the Code, that the employee is in compliance with all provisions of the Code, and that the employee has disclosed any actual or potential conflicts of interest. The certifications should be collected and maintained by VHG's General Counsel.

In connection with the Code revision, we recommend that VHG update its conflict-of-interest disclosure questionnaire to specifically inquire about ownership or financial interests in any entity that does business with VHG or any subsidiary. The current questionnaire asks general questions about conflicts of interest but does not specifically address vendor relationships, an omission that allowed the financial interests of Daskine and Prescott in the shell entities to go undisclosed. The revised questionnaire should require affirmative disclosure of any direct or indirect ownership interest, any consulting, employment, or advisory relationship, and any family relationship with any owner, officer, or principal of any VHG vendor.

C. Tone at the Top

The remediation program will be most effective if it is visibly supported by VHG's senior leadership and if VHG's employees perceive a genuine commitment to financial integrity and ethical conduct at the highest levels of the organization. We recommend the following measures to reinforce the appropriate "tone at the top":

(i) Company-Wide Communication. We recommend that CEO Margaret Calder and CFO Thomas Rhett Griffith issue a company-wide communication, in both written and video format, emphasizing VHG's commitment to financial integrity, internal controls, and ethical conduct. The communication should reference the personnel actions taken in connection with the investigation — specifically, the terminations of Daskine, Prescott, and Serrano — without disclosing privileged details of the investigation findings. The communication should clearly state that VHG will not tolerate violations of its financial-reporting obligations or its Code of Conduct, and should highlight the availability of whistleblower channels for reporting concerns.

(ii) Periodic Culture Assessment. We recommend that the Audit Committee receive periodic reports on the "tone at the top" culture within VCR specifically, including the results of employee engagement surveys, exit-interview data from departing VCR employees, and any complaints or concerns raised through the whistleblower channels. These reports should be provided at least annually and should include trend analysis to identify any deterioration in the ethical culture at VCR.

VII. Recommendations: Financial Statement Remediation

A. Restatement

VHG should proceed with the restatement of its FY 2022 financial statements (Form 10-K) and its Q1 2023 and Q2 2023 interim financial statements (Forms 10-Q) to correct the $26.4 million aggregate revenue overstatement attributable to the premature recognition of timeshare-interest deposits and the misclassification of approximately $1.83 million in fraudulent expense payments to the three shell entities. The restatement should address both the income-statement and balance-sheet effects of the corrections, including the reversal of overstated revenue, the reclassification of fraudulent payments from capital-improvement expense to loss from fraud (or such other classification as may be appropriate in consultation with HSA), and the adjustment of related tax provisions.

VHG should coordinate closely with HSA (engagement partner William Gentry) on the restatement procedures, including the scope of the re-audit required for the FY 2022 annual financial statements and any additional review procedures required for the Q1 2023 and Q2 2023 interim financial statements. Given the nature and extent of the misstatements, we anticipate that HSA will require substantial additional audit procedures before it can issue a revised audit report on the restated FY 2022 financial statements.

In parallel, VHG should coordinate with its outside securities counsel, Westlake Burris & Holt LLP (Irene Castellanos), on the preparation and filing of the amended Form 10-K and amended Forms 10-Q. The amended filings will need to include restated financial statements, revised Management's Discussion and Analysis reflecting the impact of the restatement, updated risk-factor disclosures, and revised SOX Section 302 certifications. WBH should also be consulted regarding any SEC correspondence that may be required in connection with the filing of the amended reports, including any pre-filing consultation with the SEC Division of Corporation Finance.

We note that VHG filed its Form 8-K under Item 4.02 on August 14, 2023, disclosing non-reliance on the previously issued financial statements. The amended filings sho

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT This memorandum was prepared by Calderwood & Harkness LLP at the direction of the Audit Committee of the Board of Directors of Verimark Hospitality Group Inc. in connection with an internal investigation. This document is protected by the attorney-client privilege, the work-product doctrine, and all other applicable privileges and protections. No portion of this memorandum may be disclosed to any third party without the prior written consent of the Audit Committee and Calderwood & Harkness LLP. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
MEMORANDUM
January 3, 2024
FROM: Howard Quinn, Responsible Partner, and Conrad Ashby, Billing Partner White Collar & Investigations Practice Calderwood & Harkness LLP 200 South Biscayne Boulevard, Suite 4400 Miami, FL 33131
TO: Audit Committee of the Board of Directors Verimark Hospitality Group Inc.
Diane Kowalski, Chair Reginald Faulkner, Member Sandra Yeung, Member
RE: Remediation Recommendations — Internal Investigation of Verimark Coastal Resorts LLC
C&H Matter No.: 1021-00008
Right-click to update Table of Contents
I. Introduction and Purpose
This memorandum sets forth Calderwood & Harkness LLP's ("C&H" or "the Firm") recommended remedial measures arising from the independent internal investigation conducted at the direction of the Audit Committee (the "Committee") of the Board of Directors of Verimark Hospitality Group Inc. ("VHG" or the "Company") into financial irregularities identified at Verimark Coastal Resorts LLC ("VCR"), a wholly owned Florida subsidiary of VHG. The purpose of this memorandum is to provide the Committee with a comprehensive, actionable framework for remediation that addresses the root causes of the identified misconduct, strengthens VHG's internal control environment, and positions the Company for successful resolution of the material weakness in internal controls over financial reporting currently outstanding.
The investigation was formally opened on July 24, 2023, following referral from the Committee after the communication of concerns raised during Hargrove, Steen & Aldrich LLP's ("HSA") Q1 2023 interim review. The investigation is being closed upon delivery of the Final Investigation Report, which is scheduled for January 9, 2024. This remediation memorandum is being delivered in advance of the Final Investigation Report to permit the Committee to begin deliberation on the recommended measures and to facilitate prompt implementation.
As detailed in the Final Investigation Report and summarized in Section II below, the investigation identified two distinct but related categories of misconduct at VCR: (1) premature revenue recognition of timeshare-interest deposits, resulting in an aggregate overstatement of approximately $26.4 million across four fiscal quarters (Q3 2022 through Q2 2023); and (2) an expense-reimbursement fraud scheme involving forty-seven (47) fictitious purchase orders totaling approximately $1.83 million directed to three shell entities over an approximately twenty-four-month period (July 2021 through June 2023). These two categories of misconduct, while distinct in nature and mechanism, share common root causes in the control deficiencies at the VCR division level and in the corporate oversight framework applied to VCR's operations.
The recommendations set forth herein are designed to accomplish five principal objectives:
1. Address the material weakness in VCR's internal controls over financial reporting identified by HSA during its Q1 2023 interim review, as communicated to the Committee by HSA engagement partner William Gentry on June 19, 2023.
2. Remediate the specific control deficiencies that permitted the identified misconduct to occur and persist without timely detection.
3. Restore compliance with Sections 302 and 404 of the Sarbanes-Oxley Act of 2002 ("SOX") in connection with VHG's future periodic filings with the U.S. Securities and Exchange Commission (the "SEC" or the "Commission").
4. Establish a governance and oversight framework that significantly reduces the risk of similar misconduct occurring at VCR or at any other VHG operating division in the future.
5. Demonstrate to regulators, shareholders, and other stakeholders that VHG has taken prompt, comprehensive, and good-faith remedial action in response to the identified irregularities.
These recommendations supplement the personnel actions already taken by the Company in connection with the investigation. Specifically, on December 18, 2023, VHG terminated for cause Garrett W. Daskine, Division President of VCR, and Nicole Prescott, Vice President of Finance of VCR, following the completion of the evidentiary phase of the investigation. On December 20, 2023, VHG terminated without cause Ryan Mateo Serrano, Controller of VCR, pursuant to the terms of the cooperation agreement entered into between Serrano and VHG on November 15, 2023. The cooperation agreement, which was negotiated with the involvement of Serrano's personal counsel, provided for Serrano's continued employment through the completion of his cooperation obligations in exchange for a non-cause separation, and its terms are addressed in a separate memorandum to the Committee dated November 17, 2023.
The recommendations contained herein were developed by C&H with significant input from Crestline Forensic Advisory LLC ("Crestline"), the forensic accounting firm engaged by C&H at the Committee's direction to assist with the investigation (engagement number CFA-VHG-2023-0089; engagement partner Douglas Reinhardt, CPA, CFF; senior manager Priya Venkatesh, CPA). Crestline's forensic analysis of the revenue-recognition irregularities and fictitious vendor scheme informed the specific control recommendations set forth in Sections III, IV, and V of this memorandum. Crestline has reviewed and concurs with the remediation framework described herein.
Finally, we note that VHG's outside securities counsel, Westlake Burris & Holt LLP ("WBH"), specifically Irene Castellanos, should be consulted regarding the disclosure of the remediation steps described in this memorandum in connection with the preparation and filing of the amended Form 10-K for fiscal year 2022 and the amended Forms 10-Q for Q1 2023 and Q2 2023. Disclosure considerations also arise in connection with the SEC Division of Enforcement's preliminary inquiry into VHG (File No. HO-14237), which remains pending as of the date of this memorandum. The Committee should coordinate with WBH to ensure that any public disclosure of remediation measures is consistent with VHG's legal strategy and disclosure obligations.
II. Executive Summary of Findings Giving Rise to Remediation Needs
Before setting forth our specific recommendations, we provide below a summary of the principal investigative findings that inform the remediation framework. A full discussion of the evidence, witness interviews, and analytical work supporting these findings is contained in the Final Investigation Report to be delivered on January 9, 2024. This summary is intended to provide sufficient context for the Committee's evaluation of the recommended remedial measures.
A. Revenue-Recognition Irregularities
The investigation determined that VCR systematically engaged in premature revenue recognition of timeshare-interest purchase deposits over a period spanning four fiscal quarters, from Q3 2022 (quarter ending September 30, 2022) through Q2 2023 (quarter ending June 30, 2023). The scheme involved the booking of timeshare-interest purchase deposits as completed-sale revenue upon the signing of purchase agreements, rather than deferring recognition until the expiration of the statutory ten-calendar-day rescission period mandated by Florida Statute § 721.10. Under that provision, purchasers of timeshare interests in the State of Florida have an unconditional right to cancel the purchase contract within ten days of execution, and no transfer of the timeshare interest is effective until that period has lapsed without cancellation.
During the investigated period, purchasers who exercised their rescission rights had their corresponding revenue reversals systematically deferred to the following fiscal quarter, rather than being recorded in the quarter in which the rescission occurred. This practice created a persistent overstatement of revenue that rolled forward from quarter to quarter, with the magnitude of the overstatement growing as timeshare sales activity increased at VCR's two principal timeshare properties during the period.
The aggregate revenue overstatement across the four affected quarters was approximately $26.4 million, broken down as follows:
With respect to FY 2022 specifically, the aggregate overstatement was $10.8 million (the sum of the Q3 and Q4 FY 2022 overstatements of $4.7 million and $6.1 million, respectively). At VHG's effective tax rate of 24.3% for FY 2022, this produced an after-tax net income overstatement of approximately $8.17 million. VHG reported FY 2022 net income of $142.3 million; accordingly, the after-tax income overstatement represents approximately 5.74% of reported net income — a level that is material by any commonly applied quantitative benchmark and that is particularly significant in light of the qualitative considerations attendant to intentional misconduct.
The revenue-recognition irregularities were concentrated at two VCR timeshare properties:
• Coral Dune Resort & Residences, located at 14200 Emerald Coast Parkway, Destin, Florida 32541 (Phase III timeshare units); and
• Palmetto Bluff Club, located at 3950 Longboat Key Drive, Sarasota, Florida 34228 (Phase II timeshare units).
Both properties experienced robust timeshare sales activity during the investigated period, driven in part by VCR's aggressive marketing campaigns and favorable market conditions in the Florida resort real estate sector. VCR's timeshare rescission rate during the investigated period was approximately 14.3%, compared to an industry average of approximately 11%, a differential that amplified the revenue-recognition distortion created by the premature booking practice. The higher-than-average rescission rate meant that a larger proportion of prematurely recognized revenue ultimately required reversal, and the systematic deferral of those reversals to subsequent quarters compounded the overstatement effect.
VCR reported FY 2022 revenue of approximately $438.7 million, representing approximately 23.5% of VHG's consolidated revenue of $1.87 billion. VCR is thus a material operating subsidiary, and the revenue-recognition irregularities at VCR had a direct and material impact on VHG's consolidated financial statements.
The investigation determined that the premature revenue-recognition scheme was directed by Division President Garrett W. Daskine and implemented at his instruction by Vice President of Finance Nicole Prescott. The evidence indicates that Daskine was motivated by a desire to meet or exceed quarterly revenue targets that were linked to his performance-based compensation, including annual bonuses and long-term equity incentive awards. Prescott implemented the scheme by overriding standard revenue-recognition procedures in VCR's accounting system and instructing subordinate accounting staff to record timeshare deposits as revenue upon contract execution without regard to the rescission-period requirement. The evidence supporting these findings, including documentary evidence and witness testimony, is set forth in detail in the Final Investigation Report.
B. Expense-Reimbursement Irregularities (Fictitious Vendor Scheme)
Concurrent with the revenue-recognition irregularities, the investigation identified a separate scheme involving the creation of fictitious purchase orders and the payment of fraudulent invoices to three shell entities that purported to perform capital-improvement work at VCR properties but in fact performed no work of any kind. This scheme was orchestrated by VCR Controller Ryan Mateo Serrano, who created the fictitious purchase orders in VCR's procurement system, with the knowledge and participation of Division President Daskine and VP of Finance Prescott, both of whom were beneficial owners of one or more of the shell entities.
The three shell entities involved in the scheme were as follows:
1. Gulf Standard Contracting LLC ("GSC")
GSC was formed as a Florida limited liability company on March 12, 2021. The registered agent listed in the Florida Secretary of State filings was Ryan Mateo Serrano. The beneficial owner of GSC was Garrett W. Daskine, who held his interest through a nominee arrangement designed to obscure his ownership. GSC submitted nineteen (19) invoices to VCR over the course of the scheme, totaling $812,400 in fraudulent payments.
2. Clearwater Design Collective Inc. ("CDC")
CDC was formed as a Florida corporation on June 4, 2021. The registered agent listed in the Florida Secretary of State filings was Ryan Mateo Serrano. The sole shareholder of CDC was Nicole Prescott. CDC submitted sixteen (16) invoices to VCR, totaling $587,600 in fraudulent payments.
3. Suncoast Property Services LLC ("SPS")
SPS was formed as a Florida limited liability company on November 18, 2021. The registered agent listed in the Florida Secretary of State filings was Panhandle Agent Services Inc., a commercial registered agent service based in Tallahassee, Florida. The sole member of SPS was Garrett W. Daskine, who in this instance held his interest directly. SPS submitted twelve (12) invoices to VCR, totaling $430,000 in fraudulent payments.
In total, the three shell entities submitted forty-seven (47) fictitious invoices to VCR, resulting in total improper payments of $1,830,000 ($1.83 million). The invoices purported to reflect charges for capital-improvement work at VCR properties, including lobby renovations, exterior painting, landscaping, and HVAC upgrades. No such work was actually performed by any of the three entities. The largest single fraudulent invoice was Invoice No. GSC-2023-007, dated February 14, 2023, in the amount of $94,500, purportedly for "lobby renovation materials — Coral Dune Phase III."
Crestline's forensic analysis, which included a detailed tracing of funds through the bank accounts of GSC, CDC, and SPS, determined that the fraudulent payments were used to fund personal expenditures of Daskine and Prescott, including but not limited to: residential renovation work at Daskine's personal residence located at 312 Harbor View Lane, Destin, Florida 32541; boat-slip fees at a marina facility; luxury-goods purchases at various retail establishments; and personal credit-card payments. The details of the fund-tracing analysis are set forth in Crestline's forensic accounting report, which is appended to the Final Investigation Report.
C. Summary of Control Deficiencies
The misconduct described above was enabled by a series of specific internal control failures within VCR and within VHG's corporate oversight framework. Based on our investigation, in consultation with Crestline, we have identified the following principal control deficiencies:
(i) Lack of Independent Verification of Vendor Legitimacy. VCR's vendor-onboarding process did not include independent verification of vendor legal existence, physical business address, or beneficial ownership. New vendors could be added to the approved vendor list based solely on information provided by VCR division personnel, with no independent corroboration. This deficiency permitted the three shell entities to be onboarded as VCR vendors without detection of their fraudulent nature.
(ii) Insufficient Segregation of Duties in Purchase-Order Creation and Approval. VCR's procurement system permitted the same individual — in this case, Controller Serrano — to both create and approve purchase orders below certain dollar thresholds. This lack of segregation of duties eliminated a critical check on the legitimacy of purchase orders and vendor payments, and allowed Serrano to generate and approve fictitious POs without independent review.
(iii) Absence of Real-Time Reconciliation of Timeshare Deposits Against Rescission-Period Status. VCR's revenue-recognition procedures did not include any systematic mechanism for tracking the status of timeshare purchase contracts relative to the ten-day rescission period. There was no automated hold on revenue recognition during the rescission window, and no reconciliation process to ensure that revenue was not recognized before the rescission period had expired. This deficiency allowed the premature revenue-recognition scheme to be implemented and to persist across multiple quarters.
(iv) Inadequate Review of Capital-Improvement Budgets at the Corporate Level. VHG corporate finance did not perform meaningful oversight of VCR's capital-improvement spending. Annual capital budgets were prepared and approved at the division level without substantive corporate review, and there was no mechanism for corporate-level variance analysis or verification that budgeted capital projects were actually performed. This deficiency allowed the fictitious vendor scheme to be concealed within VCR's capital-improvement spending without triggering corporate scrutiny.
(v) Over-Reliance on Division-Level Financial Self-Reporting. VHG's financial reporting framework relied extensively on division-level management to prepare and certify financial results that were then incorporated into consolidated financial statements with limited independent verification at the corporate level. This over-reliance on the accuracy and integrity of division-level reporting created an environment in which division management could manipulate financial results with a low risk of detection.
(vi) Insufficient Whistleblower Channels Accessible to Division-Level Employees. While VHG maintained a corporate whistleblower hotline, the investigation found that VCR division-level employees were largely unaware of its existence, and those who were aware perceived it as inadequate for reporting concerns about division management. Several VCR employees interviewed during the investigation stated that they had observed conduct that raised concerns but did not report those concerns because they were uncertain how to do so or feared retaliation from division management.
These control deficiencies, taken together, constitute a material weakness in internal controls over financial reporting, as communicated by HSA engagement partner William Gentry on June 19, 2023. The material weakness was publicly disclosed in VHG's Form 8-K filed with the SEC on August 14, 2023, under Item 4.02 (Non-Reliance on Previously Issued Financial Statements or a Related Audit Report or Completed Interim Review). The remediation recommendations set forth in the following sections are designed to address each of the identified control deficiencies comprehensively.
III. Recommendations: Revenue-Recognition Controls
The revenue-recognition irregularities at VCR exploited the absence of adequate controls governing the timing of revenue recognition for timeshare-interest sales. The following recommendations are designed to establish a robust control framework that prevents premature revenue recognition, ensures compliance with applicable accounting standards and Florida statutory requirements, and provides for independent verification of VCR revenue entries before their inclusion in VHG's consolidated financial statements.
A. Mandatory Reconciliation of Timeshare Deposits Against Rescission-Period Expiration
We recommend that VHG implement a system-enforced hold on the recognition of revenue for all timeshare-interest purchase deposits until the expiration of the ten-calendar-day rescission period mandated by Florida Statute § 721.10. This hold should be embedded as a hard control within VCR's enterprise resource planning ("ERP") system, such that it cannot be overridden by division-level personnel without generating an exception alert that is routed to VHG corporate accounting for review and approval.
Specifically, under the recommended control framework, revenue from timeshare-interest sales may be recognized only after the following conditions have been satisfied:
(i) The ten-calendar-day rescission period prescribed by Florida Statute § 721.10 has expired without the purchaser exercising rescission rights;
(ii) An independent reconciliation has been performed by personnel outside of VCR division management confirming that no rescission notice has been received with respect to the subject purchase agreement; and
(iii) The reconciliation has been documented and approved in the ERP system by an authorized VHG corporate accounting representative.
To support the reconciliation process, VHG should require daily automated reporting of all timeshare purchase agreements executed at VCR properties. Each report should include, at a minimum, the following data elements: purchaser name, agreement execution date, property and unit identification, contract price, deposit amount received, scheduled rescission-period maturation date (calculated as ten calendar days following the execution date), and current rescission status (pending, expired without rescission, or rescinded). These daily reports should be generated automatically from VCR's sales management system and integrated with VCR's ERP system to ensure consistency and prevent manual manipulation.
We further recommend that the reconciliation responsibility for all timeshare revenue entries in excess of defined thresholds be assigned to VHG corporate accounting personnel rather than VCR division personnel. Based on our review of VCR's timeshare sales patterns during the investigated period, we suggest that the threshold be set at $50,000 per individual transaction, with all transactions above that amount requiring corporate-level reconciliation and approval before revenue recognition. For transactions below the threshold, division-level reconciliation may be performed, subject to sample-based verification by VHG corporate accounting on a quarterly basis as described in Section III.C below.
B. ASC 606 Compliance Procedures — Timeshare-Specific Controls
The investigation revealed that VCR did not maintain a written revenue-recognition policy that specifically addressed the unique characteristics of timeshare-interest sales under Accounting Standards Codification Topic 606 (Revenue from Contracts with Customers) ("ASC 606"). The absence of such a policy contributed to the environment in which premature revenue recognition could occur. We recommend that VHG develop and implement a comprehensive written revenue-recognition policy that specifically addresses timeshare-interest sales and incorporates the five-step revenue-recognition model prescribed by ASC 606, with detailed mapping to VCR's timeshare contract structures.
The policy should address, at a minimum, the following elements:
Step 1 — Identify the Contract with a Customer. The policy should specify the criteria for determining when a valid contract exists for a timeshare-interest sale, including the requirement that the rescission period must have expired without cancellation before the contract is considered to have met the enforceability criterion under ASC 606-10-25-1.
Step 2 — Identify the Performance Obligations in the Contract. The policy should identify and distinguish the various performance obligations that may be present in a timeshare-interest sale, including the transfer of the timeshare interest itself, any associated amenities or services, and any ongoing maintenance or management obligations.
Step 3 — Determine the Transaction Price. Critically, the policy should address the rescission right as a variable-consideration element under ASC 606-10-32-7. The ten-day statutory rescission period creates a "right of return" that introduces variability into the transaction price. The policy should require estimation of expected rescissions based on historical rescission rates, with the constraint that revenue should be recognized only to the extent that it is probable that a significant reversal will not occur. Given VCR's observed rescission rate of approximately 14.3% during the investigated period — which exceeds the industry average of approximately 11% — the policy should require conservative estimation of the rescission reserve.
Step 4 — Allocate the Transaction Price to the Performance Obligations. The policy should set forth the methodology for allocating the transaction price among the identified performance obligations on a relative standalone selling-price basis.
Step 5 — Recognize Revenue When (or As) the Entity Satisfies a Performance Obligation. The policy should specify the point at which each performance obligation is satisfied, with particular emphasis on the requirement that the transfer of control of the timeshare interest does not occur until the rescission period has expired.
In addition to the policy itself, we recommend that VHG require quarterly review of the rescission-rate assumptions used in the variable-consideration estimation by VHG's corporate controller, with formal sign-off by the Chief Financial Officer, Thomas Rhett Griffith. This quarterly review should include comparison of actual rescission rates to the estimates used in the prior quarter, with an analysis of any significant variances and adjustment of future estimates as warranted.
We further recommend that VCR's revenue entries be subject to independent verification by VHG's corporate finance team before inclusion in VHG's consolidated financial statements. This verification should include, at a minimum, a review of the mathematical accuracy of the revenue entries, confirmation that the rescission-period hold has been applied, and a reasonableness check against the approved rescission-rate estimates. Any revenue entries that do not satisfy these verification criteria should be excluded from the consolidated financial statements pending resolution.
C. Quarter-End Close Procedures
To provide an additional layer of assurance at each quarter-end, we recommend the institution of a VCR-specific sub-certification process. Under this process, the VCR division finance lead (the successor to Nicole Prescott, once appointed) should be required to provide a written certification at each quarter-end affirming that all timeshare revenue recognized during the quarter has been reconciled against rescission-period expirations, that all rescission reversals have been properly recorded in the quarter in which the rescission occurred, and that no revenue has been recognized with respect to any timeshare purchase agreement for which the rescission period had not expired as of the quarter-end date. This sub-certification should be provided to the VHG corporate controller and retained as part of VHG's SOX documentation.
In addition to the sub-certification, VHG corporate finance should perform a sample-based substantive test of VCR timeshare revenue entries at each quarter-end. We recommend a minimum sample size of twenty-five percent (25%) of transactions by dollar volume, selected on a risk-weighted basis with particular focus on transactions executed in the final ten days of the quarter (where rescission periods would straddle the quarter-end date). For each sampled transaction, corporate finance should independently confirm the contract execution date, rescission-period expiration date, absence of any rescission notice, and the accuracy of the revenue amount recognized.
To address the specific issue of rescission periods that straddle quarter-end dates — which was a key mechanism through which the overstatement was generated — we recommend the establishment of a "pending revenue" suspense account. All timeshare purchase deposits for which the rescission period has not expired as of the last day of a fiscal quarter should be recorded in this suspense account rather than in revenue. Revenue from these deposits should be recognized only in the subsequent quarter, after the rescission period has expired and the reconciliation described in Section III.A has been completed. This approach may result in a modest timing shift of revenue recognition relative to current practice, but it will ensure that VCR's reported quarterly revenue is free of the rescission-period distortion that characterized the investigated period.
D. Enhanced HSA Coordination
Finally, with respect to revenue-recognition controls, we recommend that VHG's engagement with its independent auditor, HSA, be expanded to include enhanced interim-review procedures specifically focused on VCR timeshare revenue. Given the materiality of VCR's timeshare revenue to VHG's consolidated results and the history of irregularities at VCR, we believe it is appropriate for HSA to perform monthly analytical procedures during quarters with significant timeshare sales activity. These analytical procedures should include trend analysis of VCR timeshare revenue, comparison of recognized revenue to contract execution and rescission data, and review of the pending-revenue suspense account balance.
In addition, we recommend that VHG request HSA to perform targeted testing of VCR revenue-recognition entries as part of each quarterly review engagement. This targeted testing should include, at a minimum, independent confirmation of a sample of timeshare contracts to verify execution dates and rescission-period status, and recomputation of the variable-consideration adjustment based on actual rescission data. The scope and timing of HSA's enhanced procedures should be coordinated with HSA engagement partner William Gentry to ensure that they are integrated with HSA's overall audit plan and do not create inefficiencies or conflicts with the annual audit engagement.
IV. Recommendations: Vendor Management and Purchase-Order Authorization Controls
The fictitious vendor scheme at VCR was facilitated by fundamental weaknesses in VCR's vendor-management processes and purchase-order authorization controls. The following recommendations are designed to eliminate the conditions that allowed shell entities to be onboarded as approved vendors, fictitious purchase orders to be created and approved by the same individual, and fraudulent payments to be disbursed without adequate verification.
A. Vendor Approval and Onboarding Reforms
We recommend that VHG implement a centralized vendor-approval process managed at the VHG corporate level for all new vendors engaged by any VHG operating division, including VCR. Under the current decentralized framework, division-level management has the authority to onboard new vendors and add them to the approved vendor list without corporate involvement. This decentralized approach was the primary mechanism through which the three shell entities (GSC, CDC, and SPS) were introduced into VCR's vendor ecosystem. A centralized approval process will provide an independent check on vendor legitimacy and will prevent division-level personnel from onboarding vendors in which they have undisclosed financial interests.
Under the recommended centralized process, the following due-diligence steps should be completed and documented for all new vendors before they are added to the approved vendor master list:
(i) Verification of Legal Existence. VHG corporate procurement should independently verify the vendor's legal existence through review of Secretary of State filings in the state of formation. This verification should confirm the vendor's formation date, current good-standing status, registered agent, and publicly available ownership information.
(ii) Independent Confirmation of Physical Business Address. VHG corporate procurement should independently confirm that the vendor maintains a physical business address (not merely a mail-drop or virtual office) through commercially available address-verification services or, where warranted, through physical inspection.
(iii) Verification of No Employee Financial Interest. VHG corporate procurement should verify that no VHG employee, officer, or director has a direct or indirect ownership or financial interest in the vendor. This verification should include a comparison of vendor ownership information against VHG's employee, officer, and director roster, as well as review of the conflict-of-interest certifications described below.
(iv) Confirmation of Valid Business Licenses and Insurance. VHG corporate procurement should confirm that the vendor holds all business licenses required by applicable law and maintains appropriate insurance coverage, including general liability and workers' compensation insurance (for vendors providing on-site services).
(v) Reference Checks. VHG corporate procurement should obtain and verify references from at least two non-affiliated parties who have engaged the vendor for comparable services within the preceding twenty-four months. References provided by VHG employees should not be accepted.
In addition to the onboarding due diligence described above, we recommend that VHG establish a "related party" disclosure requirement applicable to all VHG employees involved in the vendor-selection or payment-approval process. Specifically, every such employee should be required to certify annually — and on an ad hoc basis when engaging a new vendor or approving a payment to an existing vendor — that they have no undisclosed financial interest in any vendor that does business with VHG or any subsidiary. This certification should be made under penalty of termination for cause and should require disclosure of any direct or indirect ownership interest, any consulting or employment relationship, any family relationship with a vendor owner or principal, and any other financial interest that could create a conflict of interest. The annual certifications should be collected by VHG's General Counsel and maintained as part of VHG's compliance records.
VHG should maintain a centralized approved-vendor master list, accessible to all divisions, with periodic re-verification of all listed vendors on at least an annual basis. The re-verification should include confirmation of continued legal existence, current good-standing status, and the continued absence of any VHG employee financial interest. Vendors that fail re-verification should be suspended from the approved list pending resolution.
Finally, we recommend that VHG implement a flag for vendors with formation dates within twelve (12) months of their first invoice to VHG or any subsidiary. Such recently formed vendors present an elevated risk of being shell entities created for fraudulent purposes, as illustrated by the GSC, CDC, and SPS entities in this case (each of which was formed within months of its first invoice to VCR). Vendors flagged under this criterion should be subject to enhanced due diligence, including a site visit by VHG internal audit or corporate procurement and more extensive reference verification.
B. Purchase-Order Authorization and Segregation of Duties
The investigation revealed that VCR's procurement system permitted a single individual to both create and approve purchase orders below certain dollar thresholds, a deficiency that was directly exploited by Controller Serrano to generate and approve the forty-seven fictitious purchase orders underlying the vendor fraud scheme. We recommend that VHG eliminate this capability entirely and implement mandatory segregation of duties such that the purchase-order creator, the purchase-order approver, and the goods-receipt confirmer are always three distinct individuals for every purchase order regardless of dollar amount.
In addition to the segregation-of-duties requirement, we recommend the implementation of tiered approval authorities, as follows:
These tiered approval thresholds are designed to ensure that higher-value purchase orders receive corporate-level scrutiny while avoiding an undue administrative burden on routine low-value transactions. We note that under the proposed thresholds, the largest single fictitious invoice in the VCR scheme — Invoice No. GSC-2023-007 in the amount of $94,500 — would have required the approval of VHG CFO Thomas Rhett Griffith and would therefore have been subjected to a level of review that would have detected its fraudulent nature. More broadly, twenty-three of the forty-seven fictitious invoices exceeded the $25,000 threshold and would have required corporate-level review, while four exceeded the $75,000 threshold and would have required CFO approval.
These approval workflows must be system-enforced within VCR's ERP and procurement system. We recommend that VHG eliminate all manual or paper-based purchase-order processes at VCR and require that all purchase orders be created, routed, and approved exclusively through the electronic procurement workflow. The system should be configured to prevent the advancement of a purchase order to the next approval stage without the required electronic approval from the designated approver, and to prevent any single user from acting in more than one approval role for a given transaction.
For capital-improvement purchase orders specifically — the category of expenditure under which the fictitious invoices were disguised — we recommend an additional control requiring photographic and documentary evidence of work completion before payment release. For all capital-improvement purchase orders exceeding $10,000, the goods-receipt confirmation should include, at a minimum: (a) before-and-after photographs of the work site; (b) an inspection report prepared by a VCR facilities management representative (other than the PO creator or approver); (c) any required lien waivers from the vendor; and (d) any applicable building permits or inspection certificates. This documentation should be uploaded to the ERP system and retained as part of the transaction record.
C. Capital-Improvement Budget Oversight
The fictitious vendor scheme was concealed in part because VHG corporate finance did not exercise meaningful oversight over VCR's capital-improvement spending. We recommend that VHG corporate finance be required to approve the annual capital-improvement budget for each VCR property — including Coral Dune Resort & Residences and Palmetto Bluff Club — and to perform quarterly variance analysis comparing actual capital expenditures to the approved budget.
Budget variances exceeding ten percent (10%) of the budgeted amount for any individual project or $50,000 in absolute terms, whichever threshold is lower, should be individually explained by VCR division management and approved by the VHG CFO before additional expenditures are authorized. This variance-analysis requirement will provide early detection of anomalous spending patterns that may indicate fraudulent activity or waste.
In addition, we recommend the implementation of a random audit program under which VHG internal audit (or the co-sourced internal audit provider, as discussed in Section V.A below) conducts unannounced site visits to VCR properties to verify that capital-improvement work purportedly performed by third-party vendors has in fact been completed as described. The frequency of these site visits should be determined based on a risk assessment, but we recommend a minimum of two unannounced visits per property per year during the initial remediation period.
D. Accounts-Payable Controls
To further strengthen the payment process and reduce the risk of fraudulent disbursements, we recommend the following enhancements to VCR's accounts-payable controls:
Three-Way Matching. VHG should require three-way matching — matching of the purchase order, the goods-receipt confirmation, and the vendor invoice — for all payments exceeding $5,000 before any disbursement is processed. The matching should be performed within the ERP system, and any discrepancies among the three documents should generate a hold on payment pending investigation and resolution. During the VCR vendor fraud scheme, invoices were paid based solely on PO approval without any independent confirmation of goods receipt, a gap that this control is designed to close.
Duplicate-Payment Detection. VHG should implement duplicate-payment detection algorithms within the accounts-payable system. These algorithms should be configured to flag invoices that share common characteristics with previously processed invoices, including matching or similar invoice numbers, identical dollar amounts, or identical vendor-and-date combinations. Flagged transactions should be reviewed by a designated AP supervisor before payment is released.
Vendor Bank-Account Change Verification. VHG should require that all changes to vendor bank-account information be independently verified through a call-back procedure to a confirmed vendor contact. The call-back must be made to a telephone number independently obtained from the vendor's verified business records — not to a number provided by the party requesting the change. This control is designed to prevent diversion of payments to fraudulent bank accounts, a common scheme vector that, while not employed in the VCR fraud, represents a foreseeable risk.
V. Recommendations: Corporate Governance and Oversight Enhancements
Beyond the specific transaction-level controls described in Sections III and IV, the investigation findings point to broader deficiencies in VHG's corporate governance and oversight framework that contributed to the environment in which the misconduct could occur and persist. The following recommendations address these structural issues.
A. Internal Audit Function
At the time the misconduct occurred, VHG did not maintain a dedicated internal audit function. Internal audit responsibilities were performed on an ad hoc basis by VHG corporate finance personnel, with no formal internal audit charter, no independent reporting line to the Audit Committee, and no systematic risk-based audit plan. This absence of a formal internal audit function is a significant gap in VHG's governance framework, particularly for a public company of VHG's size and complexity (approximately $1.87 billion in consolidated revenue and multiple operating divisions across multiple states).
We recommend the establishment of a dedicated VHG internal audit function, either through the hiring of an in-house internal audit team or through the engagement of a co-sourced internal audit provider. The internal audit function should report directly to the Audit Committee, with administrative reporting to the VHG CFO for day-to-day operational matters. The Audit Committee should approve the internal audit charter, the annual audit plan, and the internal audit budget, and should have the authority to direct the internal audit function to perform special projects or investigations as warranted.
The internal audit plan should be developed on a risk-based methodology and should include, at a minimum, annual testing of the following areas:
(i) Revenue-recognition controls, with particular emphasis on timeshare revenue at VCR and any other VHG division engaged in timeshare sales;
(ii) Vendor-management controls, including compliance with the centralized vendor-approval process and the related-party disclosure requirements;
(iii) Expense-reimbursement controls, including purchase-order authorization compliance and three-way matching adherence; and
(iv) Related-party transaction disclosures, including verification of the accuracy and completeness of annual conflict-of-interest certifications.
Given the irregularities identified at VCR, we recommend that VCR be designated as a high-risk audit area and receive enhanced internal audit coverage during at least the first two annual audit cycles following implementation of the remediation program.
B. SOX Section 404 Remediation — Material Weakness
The material weakness in VCR's internal controls over financial reporting, as identified and communicated by HSA on June 19, 2023, must be remediated before VHG can issue an unqualified management assessment of internal controls in its next annual report. The remediation of this material weakness is a critical priority for VHG and should be treated as such by management and the Board.
We recommend that VHG implement all of the revenue-recognition and vendor-management controls described in Sections III and IV of this memorandum as part of a comprehensive material-weakness remediation plan. The remediation plan should be documented in writing, with each control mapped to the specific control deficiency it is designed to address, and with a clear timeline for implementation, testing, and evaluation.
Once the new and enhanced controls are implemented, VHG should document the design of each control and test its operating effectiveness over a sufficient period to support a conclusion that the control is operating as designed. Consistent with SEC Staff guidance and PCAOB Auditing Standard No. 2201, we recommend that VHG demonstrate operating effectiveness over a period of at least two full fiscal quarters before representing that the material weakness has been remediated. The specific duration required to support a remediation conclusion should be coordinated with HSA (engagement partner William Gentry) to ensure alignment with HSA's assessment methodology.
We recommend that VHG coordinate proactively with HSA to confirm that the remediation plan described herein is sufficient in scope and design to support a conclusion that the material weakness has been remediated in time for the FY 2023 annual audit. Early engagement with HSA on the remediation plan will reduce the risk of a disagreement at year-end regarding the sufficiency of remediation and will allow VHG to make any necessary adjustments to the plan in a timely manner.
Additionally, we recommend that VHG's Chief Executive Officer, Margaret Calder, and Chief Financial Officer, Thomas Rhett Griffith, coordinate with VHG General Counsel Patricia Navarro to ensure that the SOX Section 302 certifications provided in connection with future periodic filings accurately reflect the current status of the remediation effort. Until the material weakness has been fully remediated, the Section 302 certifications should include appropriate disclosure of the material weakness and the ongoing remediation program, consistent with the requirements of Items 307 and 308 of Regulation S-K.
C. Audit Committee Reporting Enhancements
The Committee's ability to exercise effective oversight depends on the quality and timeliness of information it receives from management, internal audit, and the external auditor. We recommend the following enhancements to the Committee's reporting framework:
(i) Quarterly CFO Reports. VHG CFO Thomas Rhett Griffith should provide quarterly written reports to the Committee on: (a) the status of remediation efforts, including progress against the implementation timeline set forth in Section X below; (b) the results of any internal audit testing of VCR controls performed during the quarter; and (c) any new potential control deficiencies identified at VCR or any other VHG division. These reports should be provided in advance of regularly scheduled Committee meetings to allow for adequate review and preparation of questions.
(ii) Semi-Annual VCR Division Presentations. The Committee should receive a direct presentation from the VCR division finance lead (the successor to Nicole Prescott, once appointed) at least semi-annually regarding VCR's financial results and the state of internal controls at VCR. This direct engagement between the Committee and VCR division finance personnel will provide the Committee with an independent perspective on VCR operations and will reduce the risk of the information asymmetry that contributed to the failure to detect the misconduct.
(iii) Quarterly Executive Sessions with HSA. The Committee should engage in periodic executive sessions with HSA's engagement team, without VHG management present, at least quarterly. These sessions will provide the Committee with an opportunity to receive candid input from the external auditor on the progress of remediation, any concerns regarding the control environment, and any other matters that HSA may be reluctant to raise in the presence of management.
D. Enhanced Whistleblower and Ethics Reporting Procedures
The investigation revealed that VCR division-level employees had limited awareness of and access to VHG's whistleblower reporting mechanisms, and that those who were aware of the mechanisms did not view them as effective or safe channels for reporting concerns about division management. Strengthening these channels is essential to creating an environment in which potential misconduct is detected and reported promptly.
We recommend the following enhancements to VHG's whistleblower and ethics reporting infrastructure:
(i) Upgraded Whistleblower Hotline. VHG should upgrade its existing whistleblower hotline to ensure anonymity and accessibility for all employees, including VCR field personnel. The upgraded system should include a toll-free telephone number, a web-based reporting portal, and a mobile application, and should be available in English and Spanish (reflecting the demographics of VCR's workforce). Reports should be received and managed by a third-party hotline provider independent of VHG management to ensure anonymity.
(ii) Dedicated Ethics Reporting Channel. VHG should implement a dedicated ethics reporting channel that is separate from VCR division management and that routes reports directly to VHG's General Counsel and the Audit Committee Chair. This channel should be clearly distinguished from routine operational complaint mechanisms and should be specifically identified as a pathway for reporting suspected fraud, financial irregularities, and violations of VHG's Code of Conduct.
(iii) Publicization and Training. VHG should publicize the whistleblower and ethics reporting mechanisms through mandatory annual training for all employees, including VCR field personnel. In addition, visible signage describing the reporting mechanisms should be posted at all VCR properties, including in employee break rooms, administrative offices, and common areas.
(iv) Non-Retaliation Policy. VHG should establish a formal non-retaliation policy that provides specific protections for employees who report suspected misconduct in good faith. The policy should include specific enforcement mechanisms, such as disciplinary action against any employee found to have retaliated against a whistleblower, and should be subject to periodic auditing to ensure that complaint outcomes do not reflect patterns of retaliation.
VI. Recommendations: Compliance Training and Tone at the Top
The effectiveness of the controls and governance enhancements described in the preceding sections will depend significantly on the knowledge, awareness, and ethical commitment of VHG's personnel. The following recommendations address the human-capital dimension of the remediation program.
A. Mandatory Compliance Training
We recommend that VHG require all finance, accounting, and management personnel at both the corporate and division levels, including all VCR employees in these categories, to complete mandatory annual compliance training covering the following topics:
• Revenue-Recognition Principles Under ASC 606. This training module should address the five-step revenue-recognition model with specific application to timeshare-interest sales, including the treatment of the Florida Statute § 721.10 rescission period as a variable-consideration element. The module should incorporate case studies drawn from the VCR investigation (appropriately anonymized to protect privileged information) to illustrate the consequences of premature revenue recognition.
• Vendor-Management and Conflict-of-Interest Policies. This module should cover VHG's centralized vendor-approval process, the related-party disclosure requirements, and the prohibition on employee financial interests in VHG vendors. The module should emphasize the due-diligence steps required for vendor onboarding and the consequences of circumventing these procedures.
• Expense-Reimbursement Policies and the Prohibition on Fictitious or Inflated Claims. This module should cover VHG's purchase-order authorization procedures, the segregation-of-duties requirements, and the three-way matching controls. The module should clearly communicate that the creation of fictitious purchase orders or invoices constitutes fraud and will result in termination, civil liability, and potential criminal prosecution.
• SOX Sections 302 and 404 Obligations. This module should educate relevant personnel on the requirements of SOX Sections 302 and 404, including the personal liability of certifying officers, the definition and consequences of material weaknesses in internal controls, and the role of each employee in supporting the accuracy of VHG's financial reporting.
• Federal Securities Law Anti-Fraud Provisions. This module should provide an overview of the anti-fraud provisions of the Securities Exchange Act of 1934 (including Section 10(b) and Rule 10b-5), the penalties for securities fraud, and the role of the SEC in enforcement. This module should be designed to reinforce the seriousness of financial-reporting integrity in the context of a public company.
• Whistleblower Protections and Reporting Channels. This module should educate all employees on the available whistleblower and ethics reporting channels, the procedures for making a report, and the non-retaliation protections available to employees who report suspected misconduct in good faith.
Training should be completed within ninety (90) days of the implementation date for all current employees and within thirty (30) days of hire for new employees. Refresher training should be required annually thereafter. Completion of training should be electronically tracked, and compliance rates should be reported to the Audit Committee on a quarterly basis. Failure to complete required training within the specified timeframe should result in escalating consequences, up to and including suspension of the employee's system access and, if necessary, disciplinary action.
B. Code of Conduct and Ethics Policy Updates
We recommend that VHG revise its Code of Conduct and Ethics Policy (the "Code") to specifically address the types of misconduct identified in this investigation. The current Code, which was last revised in 2019, does not contain provisions that specifically address related-party vendor schemes, premature revenue recognition, or other forms of financial-reporting fraud. The revised Code should include clear, specific prohibitions on these types of conduct, with examples drawn from the investigation (appropriately anonymized), and should set forth the disciplinary consequences for violations.
All employees at the vice-president level and above should be required to certify their compliance with the Code on an annual basis. This certification should be a written acknowledgment that the employee has read and understood the Code, that the employee is in compliance with all provisions of the Code, and that the employee has disclosed any actual or potential conflicts of interest. The certifications should be collected and maintained by VHG's General Counsel.
In connection with the Code revision, we recommend that VHG update its conflict-of-interest disclosure questionnaire to specifically inquire about ownership or financial interests in any entity that does business with VHG or any subsidiary. The current questionnaire asks general questions about conflicts of interest but does not specifically address vendor relationships, an omission that allowed the financial interests of Daskine and Prescott in the shell entities to go undisclosed. The revised questionnaire should require affirmative disclosure of any direct or indirect ownership interest, any consulting, employment, or advisory relationship, and any family relationship with any owner, officer, or principal of any VHG vendor.
C. Tone at the Top
The remediation program will be most effective if it is visibly supported by VHG's senior leadership and if VHG's employees perceive a genuine commitment to financial integrity and ethical conduct at the highest levels of the organization. We recommend the following measures to reinforce the appropriate "tone at the top":
(i) Company-Wide Communication. We recommend that CEO Margaret Calder and CFO Thomas Rhett Griffith issue a company-wide communication, in both written and video format, emphasizing VHG's commitment to financial integrity, internal controls, and ethical conduct. The communication should reference the personnel actions taken in connection with the investigation — specifically, the terminations of Daskine, Prescott, and Serrano — without disclosing privileged details of the investigation findings. The communication should clearly state that VHG will not tolerate violations of its financial-reporting obligations or its Code of Conduct, and should highlight the availability of whistleblower channels for reporting concerns.
(ii) Periodic Culture Assessment. We recommend that the Audit Committee receive periodic reports on the "tone at the top" culture within VCR specifically, including the results of employee engagement surveys, exit-interview data from departing VCR employees, and any complaints or concerns raised through the whistleblower channels. These reports should be provided at least annually and should include trend analysis to identify any deterioration in the ethical culture at VCR.
VII. Recommendations: Financial Statement Remediation
A. Restatement
VHG should proceed with the restatement of its FY 2022 financial statements (Form 10-K) and its Q1 2023 and Q2 2023 interim financial statements (Forms 10-Q) to correct the $26.4 million aggregate revenue overstatement attributable to the premature recognition of timeshare-interest deposits and the misclassification of approximately $1.83 million in fraudulent expense payments to the three shell entities. The restatement should address both the income-statement and balance-sheet effects of the corrections, including the reversal of overstated revenue, the reclassification of fraudulent payments from capital-improvement expense to loss from fraud (or such other classification as may be appropriate in consultation with HSA), and the adjustment of related tax provisions.
VHG should coordinate closely with HSA (engagement partner William Gentry) on the restatement procedures, including the scope of the re-audit required for the FY 2022 annual financial statements and any additional review procedures required for the Q1 2023 and Q2 2023 interim financial statements. Given the nature and extent of the misstatements, we anticipate that HSA will require substantial additional audit procedures before it can issue a revised audit report on the restated FY 2022 financial statements.
In parallel, VHG should coordinate with its outside securities counsel, Westlake Burris & Holt LLP (Irene Castellanos), on the preparation and filing of the amended Form 10-K and amended Forms 10-Q. The amended filings will need to include restated financial statements, revised Management's Discussion and Analysis reflecting the impact of the restatement, updated risk-factor disclosures, and revised SOX Section 302 certifications. WBH should also be consulted regarding any SEC correspondence that may be required in connection with the filing of the amended reports, including any pre-filing consultation with the SEC Division of Corporation Finance.
We note that VHG filed its Form 8-K under Item 4.02 on August 14, 2023, disclosing non-reliance on the previously issued financial statements. The amended filings sho

MEMORANDUM

Record

Parties

Dates

Amounts