OptimizeRx Corp 10-Q

Item 4. Controls and Procedures Disclosure Controls and Procedures We maintain disclosure controls and procedures designed to provide reasonable assurance that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms and accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosures. Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, conducted an evaluation, as of the end of the period covered by this report, of the effectiveness of our disclosure controls and procedures, as such term is defined in Exchange Act Rule 13a-15(e). Based on this evaluation, our Chief Executive Officer and our Chief Financial Officer concluded that, as of the end of the period covered by this report, our disclosure controls and procedures, as defined in Rule 13a-15(e), were not effective at the reasonable assurance level due to a material weakness in our internal control over financial reporting which was disclosed in our Annual Report on Form 10-K for the year ended December 31, 2023. To address the material weakness referenced above, the Company performed additional analysis and performed other procedures in order to prepare the condensed consolidated financial statements in accordance with GAAP. Accordingly, management believes that the condensed consolidated financial statements included in this quarterly report on this Form 10-Q fairly present, in all material respects, our financial condition, results of operations and cash flows for the periods presented. 26 Plan for Remediation of Material Weakness Management is actively engaged in the planning for, and implementation of, remediation efforts to address the material weakness identified above. Management intends to implement the following remediation steps: a. The Company will require each third-party service organization to provide a SOC-1, Type 2 report to the Company for management to review and make adjustments to the remediation plans, as necessary. b. If a SOC-1, Type 2 report is not available, the Company will evaluate each third-party’s relevant system(s) and reporting directly through inquiry and substantive testing of such third-party’s control environment. c. If the Company is unable to obtain a valid SOC-1 Type 2 report or perform substantive testing of such third-party service organization’s control environment, the Company will implement a qualification and program triaging process, which would include modifying customer contracts, limiting the volume of activity with those third-parties and establishing other controls to ensure the completeness and accuracy of information received from those third-parties, such as performing tagging procedures where possible. Management believes the measures described above will remediate the material weakness that we have identified. During the quarter ended September 30, 2024, the Company continued to engage with the third-party service organizations to discuss the reporting requirements. As management continues to evaluate and improve our disclosure controls and procedures and internal controls over financial reporting, the Company may decide to take additional measures to address control deficiencies or determine to modify certain of the remediation measures identified. Changes in Internal Control over Financial Reporting Except as noted above, there was no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act), that occurred during the quarter ended September 30, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. Limitations on the Effectiveness of Controls A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. The Company conducts periodic evaluations of its internal controls to enhance, where necessary, its procedures and controls. 27 PART II – OTHER INFORMATION Item 1. Legal Proceedings From time to time, we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are currently not a party to any material legal or administrative proceedings, and we are not aware of any pending or threatened material legal or administrative proceedings against us.