CareDx, Inc. 10-K

ITEM 9A. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures Management, including our principal executive officer and principal financial officer, evaluated the effectiveness of our disclosure controls and procedures, as such terms are defined in Rules 13a-15(e) and 15d-15(e) promulgated under the Exchange Act, as of December 31, 2023. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs. Based on such evaluation, our principal executive officer and principal financial officer concluded that, as of December 31, 2023, in light of the material weaknesses identified in our internal control over financial reporting, our disclosure controls and procedures were not effective at the reasonable assurance level and are not effective to provide reasonable assurance that information required to be disclosed in the reports we file and submit under the Exchange Act, is (i) recorded, processed, summarized and reported as and when required and (ii) accumulated and communicated to our management, including the principal executive officer and principal financial officer, as appropriate to allow timely discussion regarding required disclosure. Management’s Annual Report on Internal Control over Financial Reporting Management, including our principal executive officer and principal financial officer, is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control system was designed to provide reasonable assurance regarding the preparation and fair presentation of published consolidated financial statements in accordance with accounting principles generally accepted in the United States. Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission, or COSO, in the 2013 Internal Control-Integrated Framework. Based on our assessment, management has concluded that our system of internal control over financial reporting was not effective due to the material weaknesses described below. However, after giving full consideration to these material weaknesses, and the additional analyses and other procedures we performed to ensure that our consolidated financial statements included in this Annual Report on Form 10-K were prepared in accordance with U.S. generally accepted accounting principles, or GAAP, our management has concluded that our consolidated financial statements present fairly, in all material respects, our financial position, results of operations and cash flows for the periods disclosed in conformity with GAAP. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As of December 31, 2023, the following material weaknesses have been identified: General Information Technology Controls. We did not design and maintain effective general information technology controls, or GITCs, for information systems and applications that are relevant to the preparation of the consolidated financial statements. Specifically, we did not design and maintain: (i) sufficient user access controls to ensure appropriate segregation of duties, logical access controls to prevent unauthorized user access and adequately restrict user and privileged access to financial applications, programs and data to appropriate Company personnel; (ii) program change management controls to ensure that information technology, or IT, program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately with appropriate segregation of duties; and (iii) computer and network operations controls to ensure that batch and interface jobs are monitored and privileges are appropriately granted, authorized and monitored. As a result, business process controls (automated and manual) that are dependent on the ineffective GITCs, or that rely on data produced from systems impacted by the ineffective GITCs, are also deemed ineffective, which affects substantially all financial statement account balances and disclosures. Purchase Order Approval Workflow. We did not design and maintain effective process-level control activities related to procurement to ensure appropriate approval of purchase orders, which could affect the amount and classification of costs capitalized or expensed. COSO Framework. We did not fully maintain components of the COSO framework, including elements of the control environment, information and communication, and control activities and monitoring activities components, relating to: (i) sufficiency of competent personnel to perform internal control activities and support the achievement of our internal control objectives; (ii) enforcing accountability of personnel for the performance of their internal control responsibilities across the 130 Table of Contents organization in the pursuit of objectives; (iii) designing and maintaining general control activities over technology to support the achievement of our internal control objectives; (iv) performing control activities in accordance with established policies in a timely manner; and (v) performing sufficient reviews of information to assess its relevance, accuracy, and completeness in supporting the internal control components. As such, our management concluded that we did not have an adequate process in place to complete its assessment of the design and operating effectiveness of internal control over financial reporting in a timely manner. Remediation of Prior Year Material Weaknesses As disclosed in Part II, Item 9A of our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 27, 2023, we previously identified material weaknesses related to GITCs, purchase order approval workflow and the COSO framework. During the fiscal year ended December 31, 2023, we implemented an intensive program to remediate the previously identified material weaknesses, which included expanding resources, including hiring a Chief Information and Security Officer in the third quarter of 2023, enhancing our control activities for key systems and business processes, and providing training. In addition, we performed manual procedures to validate the completeness and accuracy of the reports generated from the systems that are relevant to the preparation of the consolidated financial statements that did not have effective GITCs. While we believe that we have completed updates to the control design for the majority of our systems and purchase order approval workflow in response to the identified material weaknesses, the redesigned controls did not operate for a sufficient period of time for management to reach a conclusion regarding the operating effectiveness of the controls that were redesigned in the fiscal year ended December 31, 2023. However, our management concluded these material weaknesses did not result in any material misstatement in our financial statements or disclosures for the fiscal year ended December 31, 2023. Our management is committed to maintaining a strong internal control environment. In response to the material weaknesses described above, our management is continuing to take actions to remediate the material weaknesses in internal control over financial reporting, which include but are not limited to the following: • Continuing to enhance the design and control procedures of the GITCs to ensure that the control activities related to GITCs are functioning appropriately. • Continuing to implement training to ensure a clear understanding of risk assessment, control execution, and monitoring activities related to financial reporting and continue driving accountability of Sarbanes-Oxley Act of 2002 control activities. • Continuing to focus on controls execution and monitoring activities of internal controls related to the procure-to-pay process. • Continuing to expand the available resources at the Company with experience designing and implementing control activities, including GITCs, through hiring and use of third-party consultants and specialists. We are committed to continuing to implement a strong system of controls and believe that our ongoing remediation efforts, particularly in the improvement of our control environment, will result in significant improvements to our system of controls that we believe will remediate the material weaknesses. However, material weaknesses are not considered remediated until the new controls have been operational for a period of time, are tested, and management concludes that these controls are operating effectively. This remediation process may require additional resources and will require time to implement. We will continue to monitor the effectiveness of these remediation measures, and we will make any changes to the design of our remediation plans and take such other actions that we deem appropriate given the circumstances. Attestation Report of the Independent Registered Public Accounting Firm The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by Deloitte & Touche LLP, an independent registered public accounting firm, which has expressed an adverse opinion, as stated in their report, which appears herein. Changes in Internal Control over Financial Reporting Other than the changes associated with the material weaknesses and remediation actions noted above, there have been no changes in our internal control over financial reporting during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. 131 Table of Contents ITEM 9B. OTHER INFORMATION During the fiscal quarter ended December 31, 2023, none of our directors or officers (as defined in Section 16 of the Securities Exchange Act of 1934, as amended) adopted or terminated any contract, instruction or written plan for the purchase or sale of our securities that was intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) or any “non-Rule 10b5-1 trading arrangement,” as defined in Item 408(a) of Regulation S-K. ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS Not applicable. 132 Table of Contents PART III ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE The information required by this item is incorporated by reference from the information contained in our Definitive Proxy Statement to be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023 in connection with the Annual Meeting of Stockholders to be held in 2024, or the 2024 Proxy Statement. To the extent that we do not file the 2024 Proxy Statement by such date, we will file an amendment to this Annual Report on Form 10-K that includes the information required by this Item 10. ITEM 11. EXECUTIVE COMPENSATION The information required by this item is incorporated by reference from the information contained in the 2024 Proxy Statement. The 2024 Proxy Statement will be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023. To the extent that we do not file the 2024 Proxy Statement by such date, we will file an amendment to this Annual Report on Form 10-K that includes the information required by this Item 11. ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS The information required by this item is incorporated by reference to from the information contained in the 2024 Proxy Statement. The 2024 Proxy Statement will be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023. To the extent that we do not file our 2024 Proxy Statement by such date, we will file an amendment to this Annual Report on Form 10-K that includes the information required by this Item 12. ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS AND DIRECTOR INDEPENDENCE The information required by this item is incorporated by reference to from the information contained in our 2024 Proxy Statement. The 2024 Proxy Statement will be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023. To the extent that we do not file the 2024 Proxy Statement by such date, we will file an amendment to this Annual Report on Form 10-K that includes the information required by this Item 13. ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES The information required by this item is incorporated by reference from the information contained in the 2024 Proxy Statement. The 2024 Proxy Statement will be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023. To the extent that we do not file the 2024 Proxy Statement by such date, we will file an amendment to this Annual Report on Form 10-K that includes the information required by this Item 14. 133 Table of Contents PART IV ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES (a)(1) Financial Statements: Our Financial Statements are listed in the “Index to Consolidated Financial Statements” of CareDx, Inc. Part II, Item 8 of this Annual Report on Form 10-K. (a)(2) Financial Statement Schedules All financial statement schedules have been omitted because they are not required, not applicable, or the required information is included in the consolidated financial statements or notes thereto included in this Annual Report on Form 10-K. (a)(3) Exhibits The following exhibits are incorporated by reference or are filed with this report, in each case as indicated therein (numbered in accordance with Item 601 of Regulation S-K). Exhibit Number Incorporated by Reference Description Form File No. Exhibit Filing Date 3.1 Amended and Restated Certificate of Incorporation of the Registrant. 10-Q 001-36536 3.1 8/28/2014 3.2 Certificate of Amendment to the Amended and Restated Certificate of Incorporation of CareDx, Inc., filed June 17, 2021. 8-K 001-36536 3.1 6/21/2021 3.3 Certificate of Amendment to the Amended and Restated Certificate of Incorporation, dated June 16, 2023. 8-K 001-36536 3.1 6/20/2023 3.4 Amended and Restated Bylaws of CareDx, Inc., effective as of March 24, 2023. 8-K 001-36536 3.1 3/28/2023 4.1 Form of Registrant’s common stock certificate. 10-K 001-36536 4.1 3/31/2015 4.2# 2014 Equity Incentive Plan, as amended. 10-Q 001-36536 4.2 7/29/2021 4.3# Form of Option Agreement under the 2014 Equity Incentive Plan for New Options. SC TO-I 005-88252 99(d)(3) 10/12/2017 4.4# 2014 Employee Stock Purchase Plan and forms of agreements thereunder. S-8 333-197493 4.5 7/18/2014 4.5# 2016 Inducement Equity Incentive Plan. 10-Q 333-211538 4.5 7/29/2021 4.6# 2019 Inducement Equity Incentive Plan. 10-Q 001-36536 4.7 7/29/2021 4.7* Description of Securities of CareDx, Inc. 10.1# Form of Change of Control and Severance Agreement between the Registrant and each of its executive officers. S-1 333-196494 10.11 6/3/2014 10.2# Promotion Letter, dated May 21, 2022, by and between the Registrant and Abhishek Jain. 10-Q 001-36536 10.3 8/14/2022 10.3# Promotion Letter, dated July 12, 2021, between the Registrant and Alex Johnson. 8-K 001-36536 10.1 7/20/2021 10.4# Form of Indemnification Agreement between the Registrant and each of its directors and executive officers. S-1 333-196494 10.1 6/3/2014 10.5# Executive Incentive Compensation Plan. 10-K 001-36536 10.19 3/31/2015 10.6# Outside Director Compensation Policy, last amended December 21, 2023. 8-K 001-36536 10.1 12/22/2023 10.7 Lease, dated April 27, 2006, as amended on November 10, 2010, by and between the Registrant and BMR-Bayshore Boulevard LLC, for office and laboratory space located at 3260 Bayshore Boulevard, Brisbane, California 94005. S-1 333-196494 10.12 6/3/2014 10.8+ Second Amendment to Lease, dated January 2, 2020, by and between the Registrant and BMR-Bayshore Boulevard LP (formerly known as BMR-Bayshore Boulevard LLC), for office and laboratory space located at 3260 Bayshore Boulevard, Brisbane, California 94005. 10-Q 001-36536 10.1 4/30/2020 134 Table of Contents Exhibit Number Incorporated by Reference Description Form File No. Exhibit Filing Date 10.9+ Third Amendment to Lease, dated June 27, 2022, by and between the Registrant and BMR-Bayshore Boulevard LP. 10-Q 001-36536 10.2 11/3/2022 10.10+ Lease, dated June 14, 2022, by and between the Registrant and HCP Life Science REIT, Inc. 10-Q 001-36536 10.4 8/14/2022 10.11+ Lease, dated February 28, 2022, by and between the Registrant and One Miracle Place, LLC. 10-Q 001-36536 10.1 11/3/2022 10.12† License and Commercialization Agreement, dated May 4, 2018, between the Registrant and Illumina, Inc. 10-Q/A 001-36536 10.3 10/9/2018 10.13 Sales Agreement, dated April 14, 2022, by and between the Registrant and Jefferies LLC. 8-K 001-36536 1.1 4/15/2022 10.14#+ Separation Agreement, dated September 20, 2023, by and between CareDx, Inc. and Abraham Ronai. 10-Q 001-36536 10.1 11/8/2023 10.15#+ Legal Consulting Agreement, dated September 20, 2023, by and between CareDx, Inc. and Abraham Ronai. 10-Q 001-36536 10.2 11/8/2023 10.16+#* Consulting Agreement, dated October 30, 2023, by and between CareDx, Inc. and Reginald Seeto, MBBS. 10.17+#* Separation Agreement, dated November 1, 2023, by and between CareDx, Inc. and Reginald Seeto, MBSS. 10.18+#* Retention Bonus Letter, dated December 1, 2023, by and between CareDx, Inc. and Alex Johnson . 10.19+#* Retention Bonus Letter, dated December 1, 2023, by and between CareDx, Inc. and Abhishek Jain. 21.1* Subsidiaries of the Registrant. 23.1* Consent of Deloitte & Touche LLP, Independent Registered Public Accounting Firm. 24.1* Power of Attorney (included on the signature page of this Annual Report on Form 10-K). 31.1* Principal Executive Officer’s Certifications Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 31.2* Principal Financial Officer’s Certifications Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 32.1** Certification Pursuant to 18 U.S.C. § 1350 (Section 906 of Sarbanes-Oxley Act of 2002). 97* CareDx, Inc. Clawback Policy 101.INS* Inline XBRL Instance Document 101.SCH* Inline XBRL Taxonomy Extension Schema 101.CAL* Inline XBRL Taxonomy Extension Calculation Linkbase 101.DEF* Inline XBRL Taxonomy Extension Definition Linkbase 101.LAB* Inline XBRL Taxonomy Extension Label Linkbase 101.PRE* Inline XBRL Taxonomy Extension Presentation Linkbase 104 Cover Page Interactive Data File, formatted in Inline XBRL _____________________ † Confidential treatment has been granted with respect to certain portions of this Exhibit. Omitted portions have been filed separately with the SEC. + Non-material schedules and exhibits have been omitted pursuant to Item 601(a)(5) of Regulation S-K. The Registrant hereby undertakes to furnish supplementally copies of any of the omitted schedules and exhibits upon request by the SEC. # Indicates management contract or compensatory plan or arrangement. * Filed herewith. 135 Table of Contents ** Furnished herewith. 136 Table of Contents ITEM 16. FORM 10-K SUMMARY None. 137 Table of Contents SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized. CAREDX, INC. (Registrant) Date: February 28, 2024 By: /s/ ALEXANDER L. JOHNSON Alexander L. Johnson President of Patient and Testing Services (Principal Executive Officer) By: /s/ ABHISHEK JAIN Abhishek Jain Chief Financial Officer (Principal Accounting and Financial Officer) 138 Table of Contents POWER OF ATTORNEY KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints Alexander L. Johnson and Abhishek Jain, and each of them, his true and lawful attorneys-in-fact, each with full power of substitution, for him or her in any and all capacities, to sign any amendments to this Annual Report on Form 10-K and to file the same, with exhibits thereto and other documents in connection therewith, with the Securities and Exchange Commission, hereby ratifying and confirming all that each of said attorneys-in-fact or their substitute or substitutes may do or cause to be done by virtue hereof. Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons, on behalf of the registrant on the dates and the capacities indicated. Signature Title Date /s/ ALEXANDER L. JOHNSON President of Patient and Testing Services (Principal Executive Officer) February 28, 2024 Alexander L. Johnson /s/ ABHISHEK JAIN Chief Financial Officer (Principal Financial and Accounting Officer) February 28, 2024 Abhishek Jain /s/ GEORGE W. BICKERSTAFF, III Director February 28, 2024 George W. Bickerstaff, III /s/ FRED E. COHEN Director February 28, 2024 Fred E. Cohen /s/ GRACE COLÓN Director February 28, 2024 Grace Colón /s/ CHRISTINE M. COURNOYER Director February 28, 2024 Christine M. Cournoyer /s/ MICHAEL D. GOLDBERG Director February 28, 2024 Michael D. Goldberg /s/ WILLIAM HAGSTROM Director February 28, 2024 William Hagstrom /s/ PETER MAAG, PH.D. Director February 28, 2024 Peter Maag, Ph.D. /s/ ARTHUR TORRES Director February 28, 2024 Arthur Torres /s/ HANNAH VALANTINE Director February 28, 2024 Hannah Valantine 139