APi Group Corp 10-Q

Item 4. Controls and Procedures Evaluation of Disclosure Controls and Procedures We maintain disclosure controls and procedures that are designed to provide reasonable assurance that information required to be disclosed by us in the reports we file or submit under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating such controls and procedures, we recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. As required by Rule 13a-15(b) of the Exchange Act, our management, including our Chief Executive Officer and Chief Financial Officer, have evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this quarterly report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures are not effective as of June 30, 2023 due to the material weaknesses in internal control over financial reporting described below, which were previously disclosed in Item 9A. “Controls and Procedures” of our Form 10-K for the year ended December 31, 2022. Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their objectives as specified above. However, our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within our Company have been detected. Management’s Report on Internal Control over Financial Reporting Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a‑15(f) and 15d-15(f) under the Exchange Act. Under the supervision of our Chief Executive Officer and Chief Financial Officer, management conducted an evaluation of the effectiveness of our internal control over financial reporting as of March 31, 2023 based on the guidelines established in Internal Control — Integrated Framework (2013 Framework) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, our management concluded that our internal control over financial reporting was not effective as of June 30, 2023 due to the material weaknesses in internal control over financial reporting identified and further described below. A material weakness (as defined in Rule 12b-2 under the Exchange Act) is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. We continue to have previously identified control deficiencies that are not remediated as of June 30, 2023 related to user access controls related to an information technology system which resulted from insufficient risk assessment and ineffective operation of process level controls over revenue recognition, which resulted from insufficient training. As a result of the user access control deficiencies, process level controls at certain entities that use information from the affected system cannot be relied upon. These control deficiencies constitute material weaknesses in our internal control over financial reporting as of June 30, 2023. 50 Ongoing Remediation Plan Management has undertaken various steps to continue remediating such control deficiencies and has seen improved results versus December 31, 2022. Steps taken by us during the three months ended June 30, 2023 include the following: • Performed weekly and monthly monitoring of privileged access activity; and • Conducted training with operating company personnel related to required level of documentation and proper review of estimates related to revenue recognition. We plan to continue our efforts to strengthen our internal control over financial reporting and are committed to ensuring that such controls are operating effectively. We are implementing process and control improvements to address the above material weakness as follows: • Continue to conduct ongoing training with control owners and reviewers within operations and finance with a specific focus on sufficient documentation and evidence in the execution of the controls; and • Perform corporate level review of high risk contracts and their related revenue recognition documentation; and • Conduct an evaluation of information technology general controls ("ITGCs") and related policies, with a focus on risk assessment procedures and controls related to access to information technology ("IT") systems and implement an IT management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes. As anticipated, a remediation effort of this magnitude takes multiple years to complete and we have made significant progress with the Company’s multi-year remediation plans. Based on this progress, management believes full remediation of current material weaknesses can be achieved by year-end. In addition, under the direction of the Audit Committee of the Board of Directors, we will continue to review and make necessary changes to the overall design of the Company’s internal control environment, as well as to refine policies and procedures to improve the overall effectiveness of internal control over financial reporting of the Company. The material weaknesses in our internal control over financial reporting will not be considered remediated until the remediated controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls will be met, and no evaluation of controls can provide absolute assurance that all control deficiencies or material weaknesses have been or will be detected. There is no assurance that the remediation will be fully effective. As described above, these material weaknesses have not been remediated as of the filing date of this quarterly report. If these remediation efforts do not prove effective and control deficiencies and material weaknesses persist or occur in the future, the accuracy and timing of our financial reporting may be adversely affected. Changes in Internal Control over Financial Reporting We are executing our remediation plans to remediate the material weaknesses relating to our internal control over financial reporting, as described above. Other than changes described above, there have been no changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Securities Exchange Act of 1934, as amended) during the quarter ended June 30, 2023 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 51 PART II. OTHE R INFORMATION Item 1A. Risk factors There have been no material changes to our risk factors contained in Part I, Item 1A. "Risk Factors" of our Form 10-K for the year ended December 31, 2022.