What changed in this filing

/stocks — the workspaceLOADING

Item 4. Controls and Procedures

2026-03-11 compared with 2025-12-10 · 19 added, 21 removed, 20 unchanged (67% of the section changed)

1 unchanged sentence

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure.

accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure.

In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management is required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

As required by Rule 13a-15(b) under the Exchange Act, we carried out an evaluation, under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures, as of November 1, 2025, the end of the period covered by this Quarterly Report on Form 10-Q.

Based on the foregoing, our Chief Executive Officer and Chief Financial Officer concluded that, as of November 1 , 2025 , the end of the period covered by this Quarterly Report on Form 10-Q, our disclosure controls and procedures were effective and were operating at a reasonable assurance level.

As part of the ongoing integration of BlueHalo, we are in

process of incorporating the disclosure controls and procedures of BlueHalo.

Management’s evaluation of our disclosure

controls and procedures as of November 1, 2025 excludes an evaluation of BlueHalo’s disclosure controls and procedures that are subsumed by its internal control over financial reporting of BlueHalo.

Notwithstanding the material weaknesses, management has concluded that the financial statements included in this Quarterly Report present fairly, in all material respects, our financial position, results of operations and cash flows in conformity with U.S.

As required by Rule 13a-15(b) under the Exchange Act, we carried out an evaluation, under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures, as of January 31, 2026, the end of the period covered by this Quarterly Report on Form 10-Q.

Based on the foregoing, our Chief Executive Officer and Chief Financial Officer concluded that, as of January 31, 2026, the end of the period covered by this Quarterly Report on Form 10-Q, our disclosure controls and procedures were effective and were operating at a reasonable assurance level.

As part of the ongoing integration of BlueHalo, we are in the process of incorporating the disclosure controls and procedures of BlueHalo.

Management’s evaluation of our disclosure controls and procedures as of January 31, 2026 excludes an evaluation of BlueHalo’s disclosure controls and procedures that are subsumed by its internal control over financial reporting of BlueHalo.

Notwithstanding the material weaknesses described below in Acquisition of BlueHalo, management has concluded that the financial statements included in this Quarterly Report present fairly, in all material respects, our financial position, results of operations and cash flows in conformity with U.S.

Acquisition of BlueHalo

6 unchanged sentences

(i) program change management controls to ensure that program and data changes are identified, tested, authorized, and implemented appropriately;

(ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel.

and (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel.

Second, BlueHalo did not design and maintain an effective control environment commensurate with our financial reporting requirements.

Specifically, it did not maintain a sufficient complement of personnel with an appropriate degree of internal controls and accounting knowledge, experience, and training commensurate with its accounting and financial reporting requirements.

The limited personnel resulted in an inability to consistently establish appropriate authorities and responsibilities in pursuit of financial reporting objectives, as demonstrated by, among other things, insufficient

segregation of duties in the finance and accounting functions.

Third, BlueHalo did not design and maintain effective monitoring activities of the design and operation of controls on a timely basis, or take necessary corrective action to ensure that controls continue to operate effectively and are modified for changes in conditions as appropriate.

As of the date of this report, management’s remediation efforts are ongoing, and management has committed to a remediation plan to address the deficiencies and enhance the internal control environment.

The remediation plan includes, but is not limited to:

● Reviewed and restricted administrator level access to financial systems, ensuring that elevated privileges are limited to authorized personnel with a documented business need;

● Implementing periodic user access reviews to confirm that access rights remain appropriate and promptly removing access for terminated or transferred employees;

● Implemented a process to utilize the ticketing system to document, approve, and track changes, configuration updates and data modifications;

● Implementing management review of audit logs of select data such as vendor master changes, user roles and rates;

● Implemented a process to utilize the Okta and Single Sign On (SSO) to centralize authentication, strengthen password and multi factor authentication controls, and improve monitoring of user activity;

● Enhancing segregation of duties review within key business cycles to ensure that no single individual has control over all aspects of a financial transaction;

The remediation plan includes, but is not limited to the following activities which have been performed or are in process:

● Reviewed and restricted administrator-level access to financial systems, ensuring that elevated privileges are granted only to authorized personnel with a documented business need;

● Implemented periodic user access reviews to verify appropriateness of access rights and to promptly remove access for terminated or transferred employees;

● Implementing management review of audit logs relating to critical data and processes, such as vendor master file changes, user role modifications, and rate changes;

● Enhanced authentication controls by utilizing Okta and Single Sign-On (SSO) to centralize authentication, strengthen password and multi-factor authentication controls, and improve monitoring of user activity;

● Established processes utilizing the ticketing system to document, approve, and track system changes, configuration updates, and data modifications;

● Evaluated systems for integration with enterprise-wide monitoring tools, enabling real-time alerts for unauthorized access or unusual activity;

● Strengthened segregation of duties reviews within key business cycles to ensure that no single individual has control over all aspects of a financial transaction;

● Provided targeted training to personnel on internal control requirements, documentation standards, and change management protocols;

● Evaluating employee’s skill set and actively recruiting experienced personnel with knowledge of internal control and accounting;

● Evaluated systems to integrate with our enterprise-wide monitoring tools, enabling real-time alerts for unauthorized access or unusual activity.

● Evaluated internal skill sets and are actively recruiting experienced personnel with expertise in internal controls and accounting;

However, remedial controls must operate for a sufficient period of time for a definitive conclusion, through testing, that the deficiencies have been fully remediated and, as such, management can give no assurance that the measures it has undertaken have fully remediated the material weaknesses that it has identified or that additional material weaknesses will not arise in the future.

1 unchanged sentence

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting or in other factors identified in connection with the evaluation required by paragraph (d) of Rules 13a-15 or 15d-15 under the Exchange Act that occurred during the quarter ended November 1, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act).

There were no changes in our internal control over financial reporting or in other factors identified in connection with the evaluation required by paragraph (d) of Rules 13a-15 or 15d-15 under the Exchange Act that occurred during the quarter ended January 31, 2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act).

OTHER INFORMATIO N

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 4. Controls and Procedures