Item 9A. CONTROLS AND PROCEDURES

Evaluation of Disclosure Controls and Procedures

We carried out an evaluation, under the supervision and with the participation of our management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in the Exchange Act Rules 13a-15(e) and 15d-15(e) as of December 31, 2024. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were not effective as of December 31, 2024, due to material weaknesses in internal control over financial reporting described below.

In light of the material weaknesses described below, management performed additional analysis and other procedures to ensure that our consolidated financial statements were prepared in accordance with U.S. generally accepted accounting principles (GAAP). Accordingly, management believes that the consolidated financial statements included in this Annual Report on Form 10-K fairly present, in all material respects, our financial position, results of operations, and cash flows as of and for the periods presented, in accordance with U.S. GAAP.

Management Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting as required by the Sarbanes-Oxley Act of 2002 and as defined in Exchange Act Rules 13a-15(f) and 15d-15(f). Our system of internal control over financial reporting is designed to provide reasonable assurance to our management and Board of Directors regarding the reliability of our financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles. Internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. generally accepted accounting principles, and that receipts and expenditures are being made only in accordance with authorizations of management and our Board of Directors; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on the financial statements.

Management, including the Chief Executive Officer and Chief Financial Officer, under the oversight of our Board of Directors, evaluated the effectiveness of the Company's internal control over financial reporting, as of December 31, 2024, based on the framework in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

Management concluded that unauthorized access and changes to databases and related applications could have gone undetected as controls to review and authorize access and direct changes that support several key operational and accounting systems excluded certain changes from review, or were not captured, and as such were either not designed properly or did not operate effectively as designed. In addition, the system logic used to record direct changes excluded certain changes from being captured for review. These control deficiencies related to personnel without specific training and experience to fulfill internal control responsibilities related to information technology general controls over systems and processes resulting in an ineffective design of controls necessary to ensure the reliability of information used in financial reporting. As a consequence of these control deficiencies, the Company concluded that it did not effectively design, implement and operate process-level controls across its financial reporting processes.

The control deficiencies did not result in any identified misstatements to the consolidated financial statements, and there were no changes to previously released financial results. The control deficiencies described above created a reasonable possibility that a material misstatement to the consolidated financial statements would not be prevented or detected on a timely basis. Therefore, we concluded that the deficiencies represent material weaknesses in the Company’s internal control over financial reporting and our internal control over financial reporting was not effective as of December 31, 2024.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG LLP’s report appears on page F-3 of this Annual Report on Form 10-K.

Remediation

With respect to the material weaknesses identified, management with the oversight of the Audit Committee of the Board of Directors, has taken steps to remediate such material weaknesses, including:

Engaged PwC US Consulting, LLP to assist management with our entity-wide risk assessment, assessment of control design, and remediation process;

Continuing to conduct our entity wide risk assessments to identify relevant process risk points, IT systems and the information used in the operation of controls;

Continuing to hire additional qualified personnel to support the remediation process and the design and implementation of IT controls;

Examining additional third-party developed software solutions that aid in tracking changes to databases and related applications and improve controls over system access and monitoring;

Continuing to implement certain enhancements designed to strengthen IT change management and logical access processes; and

Continuing to train personnel to fulfill internal control responsibilities relative to information technology.

Certain steps laid out in our 2023 Annual Report on Form 10-K and quarterly reports filed in 2024 were completed, but as we continued our remediation process and review, we identified additional controls that were not designed or operated appropriately that relate to the above-described material weaknesses. These material weaknesses will not be considered fully remediated, until the applicable controls operate for a sufficient period of time and management has concluded, through additional testing, that these controls are operating effectively. Primarily due to the complexities and interdependencies of our internally developed legacy and current systems and time needed to evaluate and implement third-party software solutions, we are currently unable to estimate when full remediation of these material weaknesses will be completed. We will continue to perform supplemental review procedures for direct database changes and perform additional analysis to supplement our existing controls and other procedures to ensure that our consolidated financial statements are prepared in accordance with U.S. GAAP.

The Audit Committee has increased oversight of actions being taken by management to remediate and strengthen information technology controls. This oversight includes monthly reports and formal comprehensive presentations at all Audit Committee meetings from the Chief Information Officer, Chief Information Security Officer and Chief Technology Officer.

Changes in Internal Controls

Except for on-going remediation related to the material weaknesses noted above, there were no changes in our internal control over financial reporting that occurred during the most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

An internal control system, no matter how well-conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of such internal controls are met. Further, the design of an internal control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all internal control systems, no evaluation of controls can provide absolute assurance that all of our control issues and instances of fraud, if any, have been detected.