APi Group Corp 10-Q

ITEM 4. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures We maintain disclosure controls and procedures that are designed to provide reasonable assurance that information required to be disclosed by us in the reports we file or submit under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating such controls and procedures, we recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. As required by Rule 13a-15(b) of the Exchange Act, our management, including our Chief Executive Officer and Chief Financial Officer, have evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this quarterly report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures are not effective as of September 30, 2024 due to the material weaknesses in internal control over financial reporting described below, which were previously disclosed in Item 9A. “Controls and Procedures” of our Annual Report on Form 10-K for the year ended December 31, 2023. Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their objectives as specified above. However, our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within our Company have been detected. Management’s Report on Internal Control over Financial Reporting Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a‑15(f) and 15d-15(f) under the Exchange Act. Under the supervision of our Chief Executive Officer and Chief Financial Officer, management conducted an evaluation of the effectiveness of our internal control over financial reporting as of September 30, 2024 based on the guidelines established in Internal Control — Integrated Framework (2013 Framework) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, our management concluded that our internal control over financial reporting was not effective as of September 30, 2024 due to the material weaknesses in internal control over financial reporting identified and further described below. A material weakness (as defined in Rule 12b-2 under the Exchange Act) is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. 55 Table of Contents We continue to have previously identified control deficiencies that are not remediated as of September 30, 2024 related to user access controls specific to segregation of duties in the Company’s change management process in certain information technology systems of the Chubb fire and security business that was acquired in 2022, which resulted from ineffective risk assessment. We also continue to have previously identified control deficiencies that are not remediated as of September 30, 2024 related to adequate controls to ensure the completeness and accuracy of time keeping and service order information used in the financial reporting processes of certain businesses that is processed and hosted by a third-party service organization. These control deficiencies constitute material weaknesses in our internal control over financial reporting as of September 30, 2024. Ongoing Remediation Plan Management has undertaken various steps to continue remediating such control deficiencies and has made progress since December 31, 2023. Steps taken by us during the three months ended September 30, 2024 include the following: • Evaluated the operating effectiveness of management’s internal controls, as designed to appropriately address segregation of duties risk. This included evaluating the reporting used, review procedures performed and documented evidence of control outcomes. • Evaluated that for those conflicts determined by management to be appropriate for business purposes, management adequately evaluated and documented how the conflicts are mitigated by compensating controls, and the effectiveness of those controls. We plan to continue our efforts to strengthen our internal control over financial reporting and are committed to ensuring that such controls are operating effectively. We are implementing process and control improvements to address the above material weakness as follows: • Continue to conduct ongoing training with control owners and reviewers within operations and finance with a specific focus on sufficient documentation and evidence in the execution of the controls. • Continue to evaluate underlying process enhancement opportunities to ensure risks are mitigated to an acceptable level and ensure adequate monitoring procedures are performed where necessary. We have made progress with the Company’s remediation plans. In addition, under the direction of the Audit Committee of the Board of Directors, we will continue to review and make necessary changes to the overall design of the Company’s internal control environment, as well as to refine policies and procedures to improve the overall effectiveness of internal control over financial reporting of the Company. The material weaknesses in our internal control over financial reporting will not be considered remediated until the remediated controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls will be met, and no evaluation of controls can provide absolute assurance that all control deficiencies or material weaknesses have been or will be detected. There is no assurance that the remediation will be fully effective. As described above, these material weaknesses have not been remediated as of the filing date of this quarterly report. If these remediation efforts do not prove effective and control deficiencies and material weaknesses persist or occur in the future, the accuracy and timing of our financial reporting may be adversely affected. Changes in Internal Control over Financial Reporting We are executing our remediation plans to remediate the material weaknesses relating to our internal control over financial reporting, as described above. Other than changes described above, there have been no changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Securities Exchange Act of 1934, as amended) during the quarter ended September 30, 2024 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 56 Table of Contents PART II. OTHER INFORMATION ITEM 1A. RISK FACTORS There have been no material changes to our risk factors contained in Part I, Item 1A. "Risk Factors" of our Form 10-K for the year ended December 31, 2023.