RCI HOSPITALITY HOLDINGS, INC. 10-Q

Item 4. Controls and Procedures. Evaluation of Disclosure Controls and Procedures The Company maintains disclosure controls and procedures, defined in Rule 13a-15(e) under the Exchange Act, that are designed to ensure that the information required to be filed or submitted with the SEC under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management of the company with the participation of its principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. In connection with the preparation of this Quarterly Report on Form 10-Q for the quarter ended June 30, 2024, an evaluation was performed under the supervision and with the participation of management, including the chief executive officer and chief financial officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures. Based on their evaluation, they have concluded that our disclosure controls and procedures were not effective as of June 30, 2024. This determination is based on the previously reported material weaknesses management previously identified in our internal control over financial reporting, as described below. We are in the process of remediating the material weaknesses in our internal control, as described below. We believe the completion of these processes should remedy our disclosure controls and procedures. We will continue to monitor these issues. Previously Reported Material Weakness in Internal Control Over Financial Reporting In our Annual Report for the year ended September 30, 2023, filed with the SEC on December 14, 2023, management concluded that our internal control over financial reporting was not effective as of September 30, 2023. In the evaluation, management identified material weaknesses in internal control related (1) proper design and implementation of controls over management's review of the Company's accounting for business combinations, specifically related to the identification of and accounting for intangible assets acquired in a business combination, and over the precision of management's review of certain valuation assumptions; (2) the impairment of goodwill, indefinite-lived intangibles, and long-lived assets, specifically over the precision of management's review of certain assumptions; and (3) ineffective information technology general controls ("ITGCs") in the areas of user access and program change-management over certain information technology ("IT") systems that support the Company's financial reporting processes. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were a result of inadequate IT controls over the review of user access and imprecise documentation of procedures related to program change management. Additionally, we rely upon a variety of outsourced IT service providers for key elements of the technology infrastructure impacting our financial reporting process. Certain outsourced IT service providers could not provide System and Organization Controls ("SOC") reports for periods that closely align with our fiscal year end. Given that management did not effectively assess the design and operation of these outsourced IT service providers’ internal controls, some of our controls over IT systems and business processes were also deemed ineffective, but only to the extent that we rely upon information that was subject to the outsourced IT service providers’ control environment. These deficiencies may have an impact on our financial statements, account balances, and disclosures. Based on our evaluation, our management, with the participation of our chief executive officer and chief financial officer, concluded that our internal control over financial reporting was not effective as of September 30, 2023. Remediation Efforts to Address Material Weakness Review of Accounting for Business Combinations Management is committed to the remediation of the material weakness described above. As such, controls will be added to both increase precision of management’s review of each component of business combinations, and if necessary, retain the services of a third-party consultant to assist in the valuation and accounting for intangible assets acquired in a business combination. 37 Table of Contents Review of Accounting for Impairment of Goodwill and Intangible Assets As most of the assumptions used in the valuation models employed in impairment analyses are subjective in nature, Management will employ additional controls to validate these assumptions, including the engagement of a third-party consultant to assist developing valuation models and establishing sound and reasonable assumptions. Information Technology General Controls As a result of the material weakness, we have initiated and will continue to implement remediation measures to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) strengthening and enhancing the review and documentation procedures in our controls over user access review; (ii) define and communicate clear and concise program change management policy and procedures; (iii) enhancing the reporting requirements of accounting system audit logs; (vi) continuous improvement over our ITGC controls related to third party applications; and (vi) enhanced quarterly reporting on the remediation measures to the Audit Committee of the board of directors. It is our belief that these added controls will effectively remediate the existing material weaknesses. We believe that these actions will remediate the material weaknesses. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We expect that the remediation of these material weaknesses will be completed prior to the end of fiscal 2024. Changes in Internal Control Over Financial Reporting Other than as described above, there were no changes in the Company’s internal control over financial reporting that occurred during the quarter ended June 30, 2024, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 38 Table of Contents PART II—OTHER INFORMATION Item 1. Legal Proceedings. See the “Legal Matters” section within Note 9 of the unaudited condensed consolidated financial statements within this Quarterly Report on Form 10-Q, which information is incorporated herein by reference.