Cronos Group Inc. 10-Q

Item 4. Controls and Procedures. (a) Evaluation of Disclosure Controls and Procedures. The Company’s management, with the participation of the Chief Executive Officer and the Chief Financial Officer, performed an evaluation of the disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934 (the “Exchange Act”), as of September 30, 2020. Based on that evaluation, management has concluded that, as of September 30, 2020, due to the existence of the material weaknesses in the Company’s internal control over financial reporting described below, the disclosure controls and procedures were not effective to provide reasonable assurance that the information required to be disclosed by us in reports we file or submit under the Exchange Act were recorded, processed, summarized and reported within the time periods specified in the rules and forms of the SEC, and to ensure that the information required to be disclosed by us in reports that we file or submit under the Exchange Act, is accumulated and communicated to management, including the principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure. Material Weaknesses in Internal Controls Over Financial Reporting A material weakness is a deficiency, or combination of deficiencies in internal controls over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. As previously disclosed in the Company’s Annual Report on Form 10-K/A for the year ended December 31, 2019, we have identified the following material weaknesses in the following areas: • Risk Assessment : The Company did not appropriately design controls to monitor and respond to changes in business in relation to transactions in the wholesale market. • Segregation of Duties: The Company did not maintain adequately designed controls on segregation of purchase and sale responsibilities to ensure accurate recognition of revenue in accordance with GAAP. • Non-Routine Transactions: The Company’s controls were not effective to ensure that non-routine transactions, including deviations from contractually established sales terms, were authorized, communicated, identified and evaluated for their potential effect on revenue recognition. 56 These deficiencies create a reasonable possibility that a material misstatement to the consolidated financial statements will not be prevented or detected on a timely basis. Remediation Plan and Status The Company’s management, with oversight from the Audit Committee of the Board of Directors, has initiated a plan to remediate the material weaknesses, previously disclosed in the Annual Report on Form 10-K/A for the period ended December 31, 2019. During the first half of 2020, the Company implemented all remediation controls identified in its remediation plan as disclosed in the table below. During the nine months ended September 30, 2020, the Company enhanced its quarterly review risk assessment model and its risk control matrices, established a risk committee, which reviews the risk assessment for changes in the business, enhanced its delegation of authority policy, conducted revenue recognition training, created and implemented a non-routine transaction policy, established a review process for and reviewed its vendor and customer transactions to identify potential related transactions, implemented procedures for the preparation of business cases for all non-routine business-to-business unbranded sales and purchases, and enhanced its sub-certification processes to identify non-routine transactions. The Company has completed internal testing on all of the eight controls identified in its remediation plan. However, the Company does not expect full remediation until year end 2020. The plan and progress to date is described below: Material Weakness Control, Control Enhancement or Mitigant Implementation Status Management Testing Status Remediation Status Risk Assessment • Enhance quarterly review of risk assessment model and risk control matrices Implemented Tested • Establish a risk committee which reviews the risk assessment for changes in the business on a quarterly basis Implemented Tested Segregation of Duties • Enhance Delegation of Authority matrix to further limit groups that may authorize sales or purchases of inventory Implemented Tested • Establish review process and internal database to identify entities that are both vendors and customers of the Company Implemented Tested • Create and implement revenue recognition training Implemented Tested Non-Routine Transactions • Create and implement a Non-Routine Transactions Policy to include: Implemented Tested ◦ Definition of Non-Routine Transactions ◦ Accounting memorandum completion ◦ CEO/CFO approval • Formalization of business cases for all non-routine business to business unbranded sales and purchases to be reviewed on a quarterly basis to ensure alignment with the objectives of the business Implemented Tested • Expand the sub-certification process to additional members of management to ensure that non routine transactions are identified Implemented Tested 57 Cronos Group will continue to review, optimize, and enhance its financial reporting controls and procedures. As the Company continues to evaluate and work to improve its internal control over financial reporting, the Company may implement additional measures to address the material weaknesses or certain of the remediation measures described above may be enhanced or modified. These material weaknesses will not be considered remediated until the applicable remediated controls operate for a sufficient period of time and management has concluded, through further testing, that these controls are operating effectively. (b) Changes in Internal Control over Financial Reporting During the third quarter of 2020, the Company successfully implemented a new ERP system across the Canadian business. The new ERP system will be a meaningful component of our internal control over financial reporting and is expected to enable us to realize efficiencies throughout our finance, supply chain and operations processes. In connection with the ERP implementation, we updated the processes and controls that constitute our internal control over financial reporting, as necessary, to accommodate related changes to our accounting procedures and business processes. The Company is currently in the process of updating its processes and internal control over financial reporting in the U.S. segment for the year ended December 31, 2020. In 2019, the U.S. segment was excluded from management’s assessment of the effectiveness of the Company’s internal control over financial reporting as it was the first year of the Redwood Acquisition. Other than the ERP system, the updates of processes and internal control over financial reporting for the U.S. segment and those measures described above to remediate the material weaknesses, there were no further changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act), that occurred during the quarter ended September 30, 2020, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 58 PART II OTHER INFORMATION