OptimizeRx Corp 10-Q

Item 4. Controls and Procedures Disclosure Controls and Procedures We maintain disclosure controls and procedures designed to provide reasonable assurance that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosures. Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, conducted an evaluation, as of the end of the period covered by this report, of the effectiveness of our disclosure controls and procedures, as such term is defined in Exchange Act Rule 13a-15(e). Based on this evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, as of the end of the period covered by this report, our disclosure controls and procedures, as defined in Rule 13a-15(e), were not effective at the reasonable assurance level due to a previously identified material weakness in our internal control over financial reporting related to controls ensuring that data received from one third-party service organization were complete and accurate. To address the material weakness referenced above, the Company performed additional analysis and performed other procedures including formalized internal control audits to prepare the condensed consolidated financial statements in accordance with GAAP. Accordingly, management believes that the condensed consolidated financial statements included in this quarterly report on this Form 10-Q fairly present, in all material respects, our financial condition, results of operations and cash flows for the periods presented. Ongoing Remediation of Remaining Material Weakness As previously disclosed in our Annual Report on Form 10-K for the year ended December 31, 2025 , a material weakness in our internal control over financial reporting was identified which related to controls ensuring that data received from third-party service organizations were complete and accurate. In 2025, we remediated the material weakness with respect to three of the four third-party service organizations and the material weakness with respect to the remaining one third-party service organization is in the process of full remediation. Management, with oversight from the Audit Committee, is committed to remediating the material weakness that has been identified and maintaining an effective system of disclosure controls and procedures. These remediation efforts, summarized below, are intended to both address the identified material weakness and to enhance our overall financial control environment. Management is in the process of fully implementing process and control improvements to remediate the remaining material weakness as follows: a. The Company requires each third-party service organization to provide us, at least annually, a SOC-1 Type 2 audit report, with adequate complimentary user entity controls to ensure the data we received are complete and accurate. We rely upon a SOC-1 Type 2 audit report from each third-party service organization attesting to its internal controls. b. If a SOC-1 Type 2 audit report is not available, the Company evaluates each third-party’s relevant system(s) and control environment reporting directly through process and control reviews and at times, formal substantive testing of such third-party’s control environment to ensure the data we received are complete and accurate. c. If the Company is unable to obtain a valid SOC-1 Type 2 audit report or perform substantive testing of such third-party’s control environment, the Company implements a third-party qualification and program triaging process, which could include modifying customer contracts, limiting the volume of activity with those third-parties, and implementing additional operational controls to ensure the completeness and accuracy of information received from those third-parties, such as performing tagging procedures where possible. 29 Table of Contents When fully implemented and operational, the Company believes the measures described above will remediate the identified material weakness and strengthen the internal controls over financial reporting. The Company is committed to continuing to improve the internal control processes and will continue to review and assess our financial reporting controls and procedures on an ongoing basis. As the Company continues to evaluate and improve the internal controls over financial reporting, management may determine whether it is appropriate or necessary to take additional measures. Changes in Internal Control over Financial Reporting Except as noted above, there was no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act), that occurred during the quarter ended June 30, 2026 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. Limitations on the Effectiveness of Controls A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. The Company conducts on-going evaluations of its internal controls to enhance, where necessary, its procedures and controls. 30 Table of Contents PART II – OTHER INFORMATION Item 1. Legal Proceedings From time to time, we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are currently not a party to any material legal or administrative proceedings, and we are not aware of any pending or threatened material legal or administrative proceedings against us.