CrowdStrike’s Woes Highlight Concerns About Bespoke Accounting Metric

By any measure, the last two weeks of July have been brutal for cybersecurity firm CrowdStrike.

CrowdStrike reported what it called “exceptional” first quarter financial results in early June – taunting competitors Microsoft and Palo Alto Networks in the process. The euphoria came to an abrupt halt on July 19 when a bug in one of its routine Windows software updates caused a global tech outage that disrupted banking services, airline operations, and emergency call centers for days. CrowdStrike quickly apologized and scrambled to restore customers’ systems, blaming a “sensor configuration update” for crashing its customers’ Windows operating systems.

As it continues the uphill task of alleviating the effects of a worldwide tech meltdown, CrowdStrike now finds itself facing additional questions about its use of annual recurring revenue. CrowdStrike tends to play up ARR as one of its more prominent performance metrics. The nonstandard accounting term, which many software-as-a-service companies use to measure and market their success, has no common definition. (That differs from revenue as defined under standard accounting principles, of course.) As an example, a corporation might report ARR of $1 million from a customer with a three-year contract for $3 million.

CrowdStrike and its competitors apply ARR in their financial disclosures in different ways, though. CrowdStrike defines its ARR as “annualized value of CrowdStrike’s customer subscription contracts as of the measurement date, assuming any contract that expires during the next 12 months is renewed on its existing terms.” On the other hand, LiveRamp Holdings Inc.’s latest Form 10-K defines ARR as “the last month of quarter recurring revenue annualized.”

The main objection to these uses of ARR: Companies are realizing revenue before it is collected. Still, some issuers have made efforts in their financial filings to justify it as a valid performance measure. Digital platform presence company Yext, for example, has argued that ARR metrics can offer “insight into the performance of our recurring revenue business model while mitigating fluctuations in billing and contract terms.” For its part, LiveRamp has maintained that ARR “provides important information about our future revenue potential, our ability to acquire new customers, and our ability to maintain and expand our relationship with existing customers.”

Meanwhile, ARR citations in financial reporting often come with warnings about the pitfalls of the measure. LiveRamp has noted that “ARR is not a forecast of future revenue, which can be impacted by contract start and end dates and renewal rates.” LiveRamp has also pointed out that the lack of a standard definition reduces ARR’s utility for comparing its performance versus its peer companies.

In the end, it seems fair to acknowledge that while ARR can convey important information about a company. It can also paint a rosier picture of its performance and financial health than generally accepted accounting principles. So, when you see companies like CrowdStrike touting their ARR, make sure to read the fine print.