RCI HOSPITALITY HOLDINGS, INC. 10-Q

Item 4. Controls and Procedures. Evaluation of Disclosure Controls and Procedures The Company maintains disclosure controls and procedures, defined in Rule 13a-15(e) under the Exchange Act, that are designed to ensure that the information required to be filed or submitted with the SEC under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management of the company with the participation of its principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. In connection with the preparation of this Quarterly Report on Form 10-Q for the quarter ended June 30, 2025, an evaluation was performed under the supervision and with the participation of management, including the chief executive officer and chief financial officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures. Based on their evaluation, they have concluded that our disclosure controls and procedures were not effective as of June 30, 2025. This determination is based on the previously reported material weaknesses management identified in our internal control over financial reporting, as described below. We are in the process of remediating the material weaknesses in our internal control, as described below. We believe the completion of these processes should remedy our disclosure controls and procedures. We will continue to monitor these issues. Previously Reported Material Weakness in Internal Control Over Financial Reporting As previously reported in our Annual Report for the year ended September 30, 2024, filed with the SEC on December 16, 2024, management evaluated the effectiveness of our internal control over financial reporting as of September 30, 2024. In the evaluation, management identified material weaknesses in internal control related to (1) ineffective design and operation of controls over certain information technology general controls ("ITGCs"), including program change management, user access, and vendor management controls; (2) ineffective design and operation of controls, which include management review controls, over the accounting for business combinations; and (3) ineffective design and operation of controls, which include management review controls, over the Company's assessments of potential impairment. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective as those controls could have been adversely impacted. We believe that these control deficiencies were a result of inadequate IT controls over the review of user access and imprecise documentation of procedures related to program change management. Additionally, we rely upon a variety of outsourced IT service providers for key elements of the technology infrastructure impacting our financial reporting process. Certain outsourced IT service providers could not provide System and Organization Controls ("SOC") reports for periods that closely align with our fiscal year end. Given that management did not effectively assess the design and operation of these outsourced IT service providers’ internal controls, some of our controls over IT systems and business processes were also deemed ineffective, but only to the extent that we rely upon information that was subject to the outsourced IT service providers’ control environment. These deficiencies may have an impact on our financial statements, account balances, and disclosures. Based on our evaluation, our management, with the participation of our chief executive officer and chief financial officer, concluded that our internal control over financial reporting was not effective as of September 30, 2024. Remediation Efforts to Address Material Weakness Review of Accounting for Business Combinations Additional controls are being evaluated to both increase precision of management’s review of each component of business combinations, and if necessary, retain the services of a third-party consultant to assist in the valuation and accounting for intangible assets acquired in a business combination. 42 Table of Contents Review of Accounting for Impairment of Goodwill and Intangible Assets As most of the assumptions used in the valuation models employed in impairment analyses are subjective in nature, management will employ additional controls to validate these assumptions, including the engagement of a third-party consultant to assist developing valuation models and establishing sound and reasonable assumptions. Information Technology General Controls As a result of the material weakness, we have initiated and will continue to implement remediation measures to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) strengthening and enhancing the review and documentation procedures in our controls over user access review; (ii) defining and communicating clear and concise program change management policy and procedures; (iii) enhancing the reporting requirements of accounting system audit logs; (iv) continue to evaluate options to mitigate risks associated with the lack of available SOC reports from third-party service providers; and (v) enhanced quarterly reporting on the remediation measures to the Audit Committee of the board of directors. It is our belief that these added controls will effectively remediate the existing material weaknesses. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. The intention of management is to remediate these material weaknesses prior to the end of fiscal 2025, but there are certain initiatives that are currently unfeasible, such as the lack of available SOC reports from third-party service providers, as mentioned above. Changes in Internal Control Over Financial Reporting Other than as described above, there were no changes in the Company’s internal control over financial reporting that occurred during the quarter ended June 30, 2025, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 43 Table of Contents PART II—OTHER INFORMATION Item 1. Legal Proceedings. See the “Legal Matters” section within Note 9 of the unaudited condensed consolidated financial statements within this Quarterly Report on Form 10-Q, which information is incorporated herein by reference.