LifeMD, Inc. 10-Q

Item 4. Controls and Procedures Evaluation of Disclosure Controls and Procedures We maintain disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our chief executive officer and chief financial officer, as appropriate, to allow timely decisions regarding required disclosures. In designing disclosure controls and procedures, our management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible disclosure controls and procedures. The design of any disclosure controls and procedures also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Any controls and procedures, no matter how well designed and operated, can provide only reasonable, not absolute, assurance of achieving the desired control objectives. Our management, with the participation of our chief executive officer and chief financial officer, has evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based upon that evaluation and subject to the foregoing, our chief executive officer and chief financial officer concluded that, our disclosure controls and procedures were not effective due to the material weaknesses in internal control over financial reporting described below. Management’s Report on Internal Control Over Financial Reporting Management of our Company and its consolidated subsidiaries is responsible for establishing and maintaining adequate internal control over financial reporting. The Company’s internal control over financial reporting is a process designed under the supervision of its chief executive and chief financial officers and effected by the Company’s Board of Directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of its consolidated financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. In addition, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. Material Weakness in Internal Control over Financial Reporting Management assessed the effectiveness of the Company’s internal control over financial reporting as of June 30, 2025, based on the framework established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations (“COSO”) of the Treadway Commission. Based on this assessment, management has determined that the Company’s internal control over financial reporting was not effective. A material weakness, as defined in the standards established by the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”), is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As previously disclosed in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023, we identified material weaknesses in our internal control over financial reporting related to: (i) our information technology general controls (“ITGCs”), particularly in the areas of user access and change management within our information systems and review of key third-party service provider Systems and Organizational Controls (“SOC”) reports and (ii) business process controls related to Information Produced by the Entity (“IPE”) and system generated IPE and insufficient evidence of formal review and approval procedures of key information utilized in the performance of the control. 36 During the year ended December 31, 2024, management implemented remediation measures to address these material weaknesses, including enhancements to our ITGC controls, additional monitoring procedures, enhancements to our IPE and evidence of formal review and approval procedures, and further training. While we believe these enhancements have strengthened our internal controls and addressed the root cause of the material weaknesses, the effectiveness of these newly implemented controls has not been tested to conclude that the material weaknesses have been remediated. Management’s Plan to Remediate the Material Weakness To remediate the identified material weaknesses, our management, together with our third-party consulting firm, and with oversight from our audit committee, implemented a remediation plan. The Company has taken the following remediation steps during the year ended December 31, 2024: (i) formalized accounting and financial reporting policies and procedures including entity-level controls and segregation of duties review and analysis; (ii) documented and maintained evidence of the completeness and accuracy of manually generated IPE and system generated IPE; (iii) enhanced documentation and evidence of review of controls; and (iv) formalized user access and change management reviews as well as SOC report reviews for in-scope third-party systems. Management continues to execute these measures consistently to ensure that control deficiencies contributing to the material weaknesses are remediated, such that these controls are operating effectively over a sufficient period. The remediation, once determined to be fully operating effectively, is expected to result in the remediation of the identified material weaknesses in internal controls over financial reporting. We are committed to maintaining a strong internal control environment and believe that these remediation efforts will represent significant improvements in our control environment. Our management will continue to monitor and evaluate the relevance of our risk-based approach and the effectiveness of our internal controls and procedures over financial reporting on an ongoing basis and is committed to taking further action and implementing additional enhancements or improvements, as necessary. These material weaknesses did not result in a misstatement of the Company’s financial statements; however, they could have resulted in misstatements of interim or annual consolidated financial statements and disclosures that would result in a material misstatement that would not be prevented or detected. Changes in Internal Control over Financial Reporting As discussed above, we are implementing certain measures to remediate the material weaknesses identified in the design and operation of our internal control over financial reporting. Other than those measures, there have been no changes in our internal control over financial reporting (as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended June 30, 2025 that materially affected our internal control over financial reporting as of that date. 37 PART II – OTHER INFORMATION ITEM 1. LEGAL PROCEEDINGS In the ordinary course of our operations, we become involved in ordinary routine litigation incidental to the business. Material proceedings are described under Note 10, “Commitments and Contingencies” to the unaudited condensed consolidated financial statements included in this Quarterly Report on Form 10-Q.