Sally Beauty Holdings, Inc. 10-Q

Item 4. Controls and Procedures Controls Evaluation and Related CEO and CFO Certifications. Our management, with the participation of our principal executive officer (“CEO”) and principal financial officer (“CFO”), conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of June 30, 2026. The controls evaluation was conducted by our Disclosure Committee, comprised of senior representatives from our finance, accounting, internal audit, and legal departments under the supervision of our CEO and CFO. Certifications of our CEO and our CFO, which are required in accordance with Rule 13a-14 of the Exchange Act, are attached as exhibits to this Quarterly Report. This “Controls and Procedures” section includes the information concerning the controls evaluation referred to in the certifications, and it should be read in conjunction with the certifications for a more complete understanding of the topics presented. Limitations on the Effectiveness of Controls. We do not expect that our disclosure controls and procedures will prevent all errors and all fraud. A system of controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the system are met. Because of the limitations in all such systems, no evaluation can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been detected. Furthermore, the design of any system of controls and procedures is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions, regardless of how unlikely. Because of these inherent limitations in a cost-effective system of controls and procedures, misstatements or omissions due to error or fraud may occur and not be detected. Scope of the Controls Evaluation. The evaluation of our disclosure controls and procedures included a review of their objectives and design, our implementation of the controls and procedures and the effect of the controls and procedures on the information generated for use in this Quarterly Report. In the course of the evaluation, we sought to identify whether we had any data errors, control problems or acts of fraud and to confirm that appropriate corrective action, including process improvements, was being undertaken if needed. This type of evaluation is performed on a quarterly basis so that conclusions concerning the effectiveness of our disclosure controls and procedures can be reported in our Quarterly Reports on Form 10-Q and our Annual Reports on Form 10-K. Many of the components of our disclosure controls and procedures are also evaluated by our internal audit department, by our legal department and by personnel in our finance organization. The overall goals of these various evaluation activities are to monitor our disclosure controls and procedures on an ongoing basis and to maintain them as dynamic systems that change as conditions warrant. Conclusions regarding Disclosure Controls. Based on the required evaluation of our disclosure controls and procedures, our CEO and CFO have concluded that, as of June 30, 2026, we maintain disclosure controls and procedures that are effective in providing reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our CEO and CFO, as appropriate to allow timely decisions regarding required disclosure. Changes in Internal Control over Financial Reporting. During our most recent fiscal quarter, other than as described below, there have been no changes in our internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. During our most recent quarter, we implemented Oracle Retail Sales Audit (“ReSA”), which is used to support retail sales reconciliation and related financial reporting processes. ReSA is an application within the Oracle Retail suite that validates, reconciles, and audits point-of-sale transactions before sales data is sent to downstream systems, such as inventory, merchandising, finance, and reporting systems. The implementation impacts certain processes and controls within the Company's internal control environment. In connection with this implementation, management established new controls and modified existing controls to address risks associated with the new system and related business process changes. 24 Table of Contents PART II — OTHER INFORMATION