Cronos Group Inc. 10-Q

Item 4. Controls and Procedures. (a) Evaluation of Disclosure Controls and Procedures. The Company’s management, with the participation of the Chief Executive Officer and the Chief Financial Officer, performed an evaluation of the disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934 (the “Exchange Act”), as of September 30, 2023. Based on that evaluation, management has concluded that, as of September 30, 2023, due to the existence of a material weakness in the Company’s internal control over financial reporting described below, the disclosure controls and procedures were not effective to provide reasonable assurance that the information required to be disclosed by us in reports we file or submit under the Exchange Act were recorded, processed, summarized and reported within the time periods specified in the rules and forms of the SEC, and to ensure that the information required to be disclosed by us in reports that we file or submit under the Exchange Act, is accumulated and communicated to management, including the principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure. Material Weakness in Internal Controls Over Financial Reporting A material weakness is a deficiency, or combination of deficiencies in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. As previously disclosed in the Company’s Annual Report on Form 10-K for the year ended December 31, 2022 (the “Annual Report”), we have identified the following material weakness: • ITGCs - User Access : We did not design and maintain effective controls over Information Technology General Controls (“ITGC”), pertaining to user access management and the provisioning and monitoring of user access, including privileged access. We believe this weakness to be the result of ineffective monitoring of security administrator activities, insufficient retention of documentation to support access requests and lack of training on the importance of ITGC. This material weakness did not impact any information derived from information systems and did not result in any identified misstatements to our financial statements. Remediation Plan and Status As discussed above, we have identified a material weakness related to ITGCs in user access management and the provisioning and monitoring of privileged access. As of the filing date, the Company is in the process of implementing various initiatives intended to address the identified material weakness. In this regard, some of our key remedial initiatives include: Material Weakness Control, Control Enhancement or Mitigant Implementation Status Management Testing Status Remediation Status ITGCs • Train security administrators on access provisioning and approval protocols. Completed Tested Not Remediated • Align approval requirements for all privileged access for consistency and appropriate visibility within the IT function. Completed Tested Not Remediated • Implement a process to identify instances where privileged access roles or profiles are assigned and, when identified, review activities performed during the period of assigned privileged access. Completed In Progress Not Remediated • Implement a periodic control to compare each user’s system access to their responsibilities. Completed In Progress Not Remediated • Implement an oversight control over security administrator actions. Completed In Progress Not Remediated (b) Changes in Internal Control over Financial Reporting Other than the material weakness identified above and measures described above to remediate such material weakness, there were no changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act), that occurred during the quarter ended September 30, 2023, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 47 Table of Contents PART II OTHER INFORMATION Item 1: Legal Proceedings. The information set forth under 11(b), Contingencies, to the Company’s condensed consolidated interim financial statements included in Part I, Item 1. “Financial Statements” of this Quarterly Report is incorporated herein by reference.