SIFCO INDUSTRIES INC 10-Q

Item 4. Controls and Procedures As defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), disclosure controls and procedures are controls and procedures designed to ensure that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported on a timely basis, and that such information is accumulated and communicated to management, including the Company’s Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure. The Company’s disclosure controls and procedures include components of the Company’s internal control over financial reporting. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management is required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Management of the Company, under the supervision and with the participation of the Chief Executive Officer and Chief Financial Officer, carried out an evaluation of the effectiveness of the design and operation of the Company’s disclosure controls and procedures pursuant to Exchange Act Rule 13a-15(e) as of June 30, 2023 (the “Evaluation Date”). Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, as of the Evaluation Date, the Company’s disclosure controls and procedures were not effective, as a result of the continuing existence of the material weakness in the Company's internal controls over financial reporting described in Item 9A of the Company's Annual Report. In the first quarter of fiscal 2023, the Company identified the following material weakness: • On December 30, 2022, the Company experienced a cybersecurity incident that led to a disruption of its domestic operations. As a result of the cyber incident and its residual effects, the Company identified deficiencies in its oversight and backup and recovery controls that represent a material weakness in internal control over financial reporting. See Note 12, Commitments and Contingencies . The Company is in the process of designing and implementing improved controls to remediate the material weakness that continued to exist as of June 30, 2023. Remediation Plan for Material Weakness in Internal Control over Financial Reporting Management and the Company's Board of Directors are committed to improving the Company's overall system of internal controls over financial reporting. To address the material weakness identified in our control environment, the Company is taking the following actions: With respect to cybersecurity controls, the Company has redeployed enhanced endpoint protection and detection tools, implemented new back-up protocols and increased oversight on its information technology systems. The actions we are taking are subject to ongoing senior management review as well as oversight by the Audit Committee of the Board of Directors. Although we plan to complete this remediation as quickly as possible, we cannot, at this time, estimate how long it will take. Changes in Internal Control over Financial Reporting Except for the remediation items described in Item 4 related to prior quarter findings, there have been no changes in the Company's internal controls over financial reporting during the Company's most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, the Company's internal controls over financial reporting. Part II. Other Information Items 1, 2, 3, 4 and 5 are not applicable or the answer to such items is negative; therefore, the items have been omitted and no reference is required in this Quarterly Report.