Item 4. Controls and Procedures
ITEM 4. CONTROLS AND PROCEDURES
Evaluation of Disclosure Controls and Procedures
We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure.
In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management is required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures.
As required by Rule 13a-15(b) under the Exchange Act, we carried out an evaluation, under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures, as of January 31, 2026, the end of the period covered by this Quarterly Report on Form 10-Q/A.
In connection with the restatement of our unaudited condensed consolidated financial statements for the period ended January 31, 2026, our principal executive officer and principal financial officer have re-assessed their conclusion on disclosure controls and procedures, concluding that, due to the material weakness in our internal control over financial reporting as described below, our disclosure controls and procedures were not effective as of January 31, 2026.
Notwithstanding the material weaknesses described below in Material Weakness in Connection with the Restatement and Acquisition of BlueHalo, management has concluded that the financial statements included in this Quarterly Report
46
Table of Contents
present fairly, in all material respects, our financial position, results of operations and cash flows in conformity with U.S. GAAP.
Material Weakness in Connection with the Restatement
A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.
We determined that the error resulting in the restatement of our unaudited condensed consolidated financial statements for the quarter ended January 31, 2026 in this Form 10-Q/A originated from a newly identified material weakness. The material weakness relates to the design of controls over the preparation and review of our goodwill impairment analysis. Specifically, we did not have a properly designed control requiring preparation and review of a reconciliation of goodwill by reporting unit.
Remediation Plan in Connection with the Restatement
We are in the process of, and continue to focus on, designing and implementing effective measures to strengthen our internal control over the reconciliation of goodwill by reporting unit and remediate the material weakness. Our planned remediation is to implement a control over the preparation and review of a quarterly reconciliation of goodwill by reporting unit.
We believe the measure described above will remediate the material weakness identified and strengthen our internal control over financial reporting. However, remedial controls must operate for a sufficient period of time and management must determine, through testing, that the deficiencies have been remediated. Management can give no assurance that the planned measure will remediate the identified material weakness or that additional material weaknesses will not arise in the future. Management will continue to monitor the effectiveness of this and other processes, procedures, and controls and will make any further changes that management determines to be appropriate.
Acquisition of BlueHalo
On May 1, 2025, we completed the acquisition of BlueHalo, a U.S. non-public reporting company. Prior to the acquisition, in connection with the preparation of its audited consolidated financial statements for the year ended December 31, 2024, BlueHalo identified three material weaknesses in its internal control over financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. First, BlueHalo did not design and maintain effective information technology (“IT”) general controls for information systems that are relevant to the preparation of its financial statements. Specifically, BlueHalo did not design and maintain: (i) program change management controls to ensure that program and data changes are identified, tested, authorized, and implemented appropriately; and (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel. Second, BlueHalo did not design and maintain an effective control environment commensurate with our financial reporting requirements. Specifically, it did not maintain a sufficient complement of personnel with an appropriate degree of internal controls and accounting knowledge, experience, and training commensurate with its accounting and financial reporting requirements. The limited personnel resulted in an inability to consistently establish appropriate authorities and responsibilities in pursuit of financial reporting objectives, as demonstrated by, among other things, insufficient segregation of duties in the finance and accounting functions. Third, BlueHalo did not design and maintain effective monitoring activities of the design and operation of controls on a timely basis, or take necessary corrective action to ensure that controls continue to operate effectively and are modified for changes in conditions as appropriate.
Management’s remediation efforts are ongoing, and management has committed to a remediation plan to address the deficiencies and enhance the internal control environment. The remediation plan includes, but is not limited to the following activities which have been performed or are in process:
● Reviewed and restricted administrator-level access to financial systems, ensuring that elevated privileges are granted only to authorized personnel with a documented business need;
47
Table of Contents
● Implemented periodic user access reviews to verify appropriateness of access rights and to promptly remove access for terminated or transferred employees;
● Implementing management review of audit logs relating to critical data and processes, such as vendor master file changes, user role modifications, and rate changes;
● Enhanced authentication controls by utilizing Okta and Single Sign-On (SSO) to centralize authentication, strengthen password and multi-factor authentication controls, and improve monitoring of user activity;
● Established processes utilizing the ticketing system to document, approve, and track system changes, configuration updates, and data modifications;
● Evaluated systems for integration with enterprise-wide monitoring tools, enabling real-time alerts for unauthorized access or unusual activity;
● Strengthened segregation of duties reviews within key business cycles to ensure that no single individual has control over all aspects of a financial transaction;
● Provided targeted training to personnel on internal control requirements, documentation standards, and change management protocols;
● Evaluated internal skill sets and are actively recruiting experienced personnel with expertise in internal controls and accounting;
However, remedial controls must operate for a sufficient period of time and management must determine, through testing, that the deficiencies have been remediated. Management can give no assurance that the measures it has undertaken have remediated the material weaknesses that it has identified or that additional material weaknesses will not arise in the future. Management will continue to monitor the effectiveness of these and other processes, procedures, and controls and will make any further changes that management determines to be appropriate.
Changes in Internal Control over Financial Reporting
Other than the identification of the material weakness described above, there were no changes in our internal control over financial reporting or in other factors identified in connection with the evaluation required by paragraph (d) of Rules 13a-15 or 15d-15 under the Exchange Act that occurred during the quarter ended January 31, 2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act).
48
Table of Contents
PART II. OTHER INFORMATIO N
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.