OptimizeRx Corp 10-Q

Item 4. Controls and Procedures Disclosure Controls and Procedures We maintain disclosure controls and procedures designed to provide reasonable assurance that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms and accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosures. Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, conducted an evaluation, as of the end of the period covered by this report, of the effectiveness of our disclosure controls and procedures, as such term is defined in Exchange Act Rule 13a-15(e). Based on this evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, as of the end of the period covered by this report, our disclosure controls and procedures, as defined in Rule 13a-15(e), were not effective at the reasonable assurance level due to a previously identified material weakness in our internal control over financial reporting related to controls to ensure that data received from third-party service organizations were complete and accurate. To address the material weakness referenced above, the Company performed additional analysis and performed other procedures in order to prepare the condensed consolidated financial statements in accordance with GAAP. Accordingly, management believes that the condensed consolidated financial statements included in this quarterly report on this Form 10-Q fairly present, in all material respects, our financial condition, results of operations and cash flows for the periods presented. Ongoing Remediation of Previously Identified Material Weakness As previously disclosed , a material weakness in our internal control over financial reporting was identified which related to controls to ensure that data received from third-party service organizations were complete and accurate. Management, with oversight from the Audit Committee of our Board of Directors, is committed to remediating the material weakness that has been identified and maintaining an effective system of disclosure controls and procedures. These remediation efforts, summarized below, are intended to both address the identified material weakness and to enhance our overall financial control environment. Management is in the process of fully implementing process and control improvements to address the above material weakness previously identified as follows: 24 Table of Contents a. The Company requires each third-party service organization to provide us, at least annually, a SOC-1 Type 2 report, with adequate controls to ensure the data we receive are complete and accurate. We rely upon a SOC-1 Type 2 report from the service organizations attesting to the vendor’s internal controls. b. If a SOC-1 Type 2 report is not available, the Company evaluates each third-party’s relevant system(s) and control environment reporting directly through inquiry and substantive testing of such third-party’s control environment to ensure the data we receive are complete and accurate. c. If we are unable to obtain a valid SOC-1 Type 2 report or perform substantive testing of such third-party’s control environment, the Company implements a thirty-party qualification and program triaging process, which could include modifying customer contracts, limiting the volume of activity with those third-parties, and establishing other controls to ensure the completeness and accuracy of information received from those third-parties, such as performing tagging procedures where possible. To further execute on its remediation efforts of the material weakness, management took the following additional steps: a. Hired a Senior Vice President of internal controls and engaged a third-party consulting firm. b. Developed a framework to assess whether data received from third-party service organizations were complete and accurate. The material weakness will be considered remediated when management concludes that, through testing, the applicable remedial controls are designed and implemented effectively. When fully implemented and operational, we believe the measures described above will remediate the material weakness we have identified and strengthen our internal control over financial reporting. This material weakness will not be considered remediated until the newly implemented internal controls operate for a sufficient period of time and management has concluded, through testing, that these internal controls are operating effectively. We are working to have the material weakness remediated as soon as possible. We are committed to continuing to improve our internal control processes and will continue to review and assess our financial reporting controls and procedures on an ongoing basis. As we continue to evaluate and improve our internal control over financial reporting, our management may determine whether it is appropriate or necessary to take additional measures. Changes in Internal Control over Financial Reporting Except as noted above, there was no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act), that occurred during the quarter ended March 31, 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. Limitations on the Effectiveness of Controls A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. The Company conducts periodic evaluations of its internal controls to enhance, where necessary, its procedures and controls. 25 Table of Contents PART II – OTHER INFORMATION Item 1. Legal Proceedings From time to time, we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are currently not a party to any material legal or administrative proceedings, and we are not aware of any pending or threatened material legal or administrative proceedings against us.