Item 9A. Controls and Procedures.

Evaluation of disclosure controls and procedures

The Company’s Chief Executive Officer and Chief Financial Officer, after evaluating the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rules 13a-15 (f) and 15d-15(f) under the Securities Exchange Act of 1934) as of December 31, 2024, have concluded that as of such date the Company’s disclosure controls and procedures were adequate and effective at a reasonable assurance level and designed to ensure that material information relating to the Company and its consolidated subsidiaries would be made known to such officers on a timely basis.

Management’s report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. The Company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of the Company’s consolidated financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the Company’s consolidated financial statements. In order to ensure the Company’s internal control over financial reporting is effective, management regularly assesses such control and did so most recently for its financial reporting as of December 31, 2024.

Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting based on the criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 Framework). This evaluation included review of the documentation, evaluation of the design effectiveness and testing of the operating effectiveness of controls. The Company’s system of internal control over financial reporting is enhanced by periodic reviews by the Company’s internal auditors, written policies and procedures and a written Code of Conduct adopted by CVS Health Corporation’s Board of Directors, applicable to all employees of the Company. In addition, the Company has an internal Disclosure Committee, comprised of management from each functional area within the Company, which performs a separate review of disclosure controls and procedures. There are inherent limitations in the effectiveness of any system of internal control over financial reporting.

Based on management’s assessment, management concluded that the Company’s internal control over financial reporting is effective and provides reasonable assurance that assets are safeguarded and that the financial records are reliable for preparing financial statements as of December 31, 2024.

Ernst & Young LLP, the Company’s independent registered public accounting firm, is appointed by CVS Health Corporation’s Board of Directors and ratified by CVS Health Corporation’s stockholders. They were engaged to render an opinion regarding the fair presentation of the Company’s consolidated financial statements as well as conducting an audit of internal control over financial reporting. Their reports included in Item 8 of this Form 10-K are based upon audits conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States).

Changes in internal control over financial reporting

There has been no change in the Company’s internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of Rule 13a-15 or Rule 15d-15 that occurred during the fourth quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.