Business First Bancshares, Inc. 10-Q

Item 4. Controls and Procedures Evaluation of Disclosure Controls and Procedures Under the supervision and with the participation of our principal executive officer and principal financial officer, we have evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a – 15(e) and 15d – 15(e) under the Securities Exchange Act of 1934, as amended) as of the end of the period covered by this Report. Based on such evaluation, our principal executive officer and principal financial officer concluded our disclosure controls and procedures were effective as of the end of the period covered by this Report to provide reasonable assurance that the information we are required to disclose in reports that are filed or furnished under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the rules and forms of the SEC, including to ensure that such information is accumulated and communicated to management, including our principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. The effectiveness of our, or any, system of disclosure controls and procedures is subject to certain limitations, including the exercise of judgment in designing, implementing and evaluating the controls and procedures, the assumptions used in identifying the likelihood of future events, and the inability to eliminate misconduct completely. As a result, we cannot assure you that our disclosure controls and procedures will detect all errors or fraud. Remediation of Material Weakness As previously reported in Item 9A of our Annual Report on Form 10-K for the year ended December 31, 2024, management identified a material weakness in our internal control over financial reporting related to design and operation of information technology general controls (“ITGCs”) around change management segregation of duties with respect to certain information technology (“IT”) systems that support our financial reporting process, which we have outsourced to a third party service provider. Management has implemented remediation steps to address the material weakness through (i) an independent audit firm performing agreed upon procedures (“AUP”) testing and confirming the segregation of duty control had been appropriately remediated during the first quarter of 2025, and (ii) the Company’s monitoring of the third party service provider’s system during the first and second quarter of 2025 to ensure that no changes occurred with respect to the area of the IT system in which the material weakness was identified. Additionally, the Company successfully converted to a new core processing system during the last week of May 2025 and is no longer relying on the previous core processing system. The Company has concluded that, as of June 30, 2025, the material weakness has been effectively remediated. Changes in Internal Controls over Financial Reporting Except as described above under "Remediation of Material Weakness", there were no changes in our internal control over financial reporting during the period covered by this Report that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. 70 Table of Contents PART II. OTHER INFORMATION