RCI HOSPITALITY HOLDINGS, INC. 10-Q

Item 4. Controls and Procedures. Evaluation of Disclosure Controls and Procedures The Company maintains disclosure controls and procedures, defined in Rule 13a-15(e) under the Exchange Act, that are designed to ensure that the information required to be filed or submitted with the SEC under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management of the company with the participation of its principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. In connection with the preparation of this Quarterly Report on Form 10-Q for the quarter ended June 30, 2026, an evaluation was performed under the supervision and with the participation of management, including the interim chief executive officer and interim chief financial officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures. Based on their evaluation, they have concluded that our disclosure controls and procedures were not effective as of June 30, 2026. This determination is based on the previously reported material weaknesses management identified in our internal control over financial reporting, as described below. We are in the process of remediating the material weaknesses in our internal control, as described below. We believe the completion of these processes should remedy our disclosure controls and procedures. We will continue to monitor these issues. Previously Reported Material Weakness in Internal Control Over Financial Reporting In our Annual Report for the year ended September 30, 2025, filed with the SEC on March 19, 2026, management concluded that our internal control over financial reporting was not effective as of September 30, 2025. In the evaluation, management identified material weaknesses in internal control related (1) ineffective design and operation of controls over certain information technology general controls ("ITGCs"), including program change management and vendor management controls; (2) ineffective design and operation of controls, which include management review controls, over the accounting for business combinations and contingent liabilities; and (3) ineffective design and operation of controls, which include management review controls, over the impairment assessments over long-lived assets, definite- and indefinite-lived intangible assets, and goodwill. The identified ITGC control deficiencies resulted from two factors. First, the Company's procedures governing program change management were insufficiently documented, resulting in controls that could not be consistently evidenced. Second, the Company relies on third-party IT service providers for certain key components of the technology infrastructure supporting its financial reporting processes. Specifically, certain service providers supporting applications within the Company's revenue cycle were unable to provide System and Organization Controls ("SOC") reports, thus management was unable to effectively evaluate the design and operating effectiveness of the internal controls maintained by these service providers. Consequently, certain business process controls were determined to be ineffective, limited to the extent those controls rely upon information processed within, or subject to, the 38 Table of Contents control environments of the applicable third-party service providers. These deficiencies may have an impact on our financial statements, account balances, and disclosures. Based on our evaluation, our management, with the participation of our chief executive officer and chief financial officer, concluded that our internal control over financial reporting was not effective as of September 30, 2025. Remediation Efforts to Address Material Weakness Review of Accounting for Business Combinations and Contingent Liabilities Management has re-evaluated the design of its controls over the accounting for business combinations and will continue to implement enhancements to improve the precision, documentation, and timeliness of review procedures. Management has re-evaluated the design of its controls over the accounting for legal contingencies and will implement enhancements to improve the clarity and quality of documentation supporting review of legal contingencies, including related legal fees and unasserted claims. Review of Impairment Assessments over Long-lived Assets, Definite- and Indefinite-lived Intangible Assets, and Goodwill Given the inherently subjective nature of the assumptions underlying the valuation models used in impairment analyses, management will re-evaluate the review procedures to strengthen the validation and documentation of such assumptions. Information Technology General Controls As a result of the material weakness and its ongoing remediation efforts, management has enhanced internal change monitoring procedures. However, complete remediation is dependent in part on obtaining sufficient third-party assurance reporting (e.g. SOC reports) from certain key service providers, which management is actively pursuing. Management is also evaluating alternative options in the event it is determined that the third parties cannot provide the required reports or alternative documentation. As a result, management currently expects that remediation of these material weaknesses will extend beyond fiscal 2026 and is actively evaluating options to complete remediation during fiscal 2027. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. Further, management is committed to continued quarterly reporting on remediation measures to the Audit Committee of the board of directors. Changes in Internal Control Over Financial Reporting Other than as described above, there were no changes in the Company’s internal control over financial reporting that occurred during the quarter ended June 30, 2026, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting. 39 Table of Contents PART II— OTHER INFORMATION Item 1. Legal Proceedings. See the “Legal Matters” section within Note 9 of the unaudited condensed consolidated financial statements within this Quarterly Report on Form 10-Q, which information is incorporated herein by reference.