EZCORP INC 10-Q

ITEM 4. CONTROLS AND PROCEDURES This report includes the certifications of our Chief Executive Officer and Chief Financial Officer required by Rule 13a-14 of the Securities Exchange Act of 1934 (the "Exchange Act"). See Exhibits 31.1 and 31.2. This Item 4 includes information concerning the controls and control evaluations referred to in those certifications. Evaluation of Disclosure Controls and Procedures Disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934) are designed to ensure that information required to be disclosed in the reports we file or submit under the Securities Exchange Act is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding required disclosures. Under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer, our management evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of June 30, 2020 . Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were not effective as of June 30, 2020 due to the continuing existence of a material weakness in internal control over financial reporting described below (which we view as an integral part of our disclosure controls and procedures). Based on the performance of additional procedures designed to ensure the reliability of our financial reporting, we believe that the condensed 41 Table of Contents consolidated financial statements included in this Quarterly Report on Form 10-Q fairly present, in all material respects, our financial position, results of operations and cash flows as of the dates, and for the periods, presented, in conformity with GAAP. Changes in Internal Control Over Financial Reporting During the second quarter of fiscal 2019, we identified deficiencies in our information technology general controls (ITGCs) that are designed to prevent or detect unauthorized access or changes to certain information technology (IT) systems that support our financial reporting processes. Our related IT dependent manual and application controls that are impacted by the affected ITGCs were also deemed ineffective as they rely on reports generated by the IT systems subject to ITGCs, resulting in our inability to place reliance on internal controls over related financial statement accounts and assertions. At that time, we determined that the ITGC deficiencies represent a material weakness in our internal control over financial reporting and reported that material weakness in our Quarterly Report on Form 10-Q for the quarter ended March 31, 2019. Because we have not completed the remediation of that material weakness as of June 30, 2020, we have concluded our internal control over financial reporting was not effective as of that date. During the quarter ended June 30, 2020 , we have continued to implement, manage and monitor a remediation plan focused on IT control enhancements across our logical access and change management processes, including the evaluation of automation tools, where applicable, and database monitoring activities. Management believes it is taking the appropriate steps to remediate the underlying ITGC deficiencies, including allowing the controls to operate for a time period to produce sufficient testing sample sizes. Inherent Limitations on Internal Controls Our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls or our internal controls will prevent or detect all errors and all fraud. A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been detected. The design of any system of controls is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with associated policies or procedures. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. PART II — OTHER INFORMATION ITEM 1. LEGAL PROCEEDINGS See Note 11 of Notes to Interim Condensed Consolidated Financial Statements included in "Part I, Item 1 — Financial Statements." 42 Table of Contents