TRANSACT TECHNOLOGIES INC 10-Q

Item 4. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures Our management, with the participation of our Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), evaluated the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) under the Exchange Act as of September 30, 2020. In the Amendment to our Annual Report on Form 10-K for the year ended December 31, 2018, filed with the SEC on November 21, 2019, we disclosed that management, including our CEO and CFO, concluded that our disclosure controls and procedures were not effective as of December 31, 2018, due to material weaknesses in our internal control over financial reporting as described below. As of September 30, 2020, we have fully remediated one of the material weaknesses, while one material weakness was not fully remediated; as a result, our disclosure controls and procedures were not effective as of September 30, 2020. Management is undertaking efforts to remediate the remaining material weakness, which is described below. Notwithstanding the material weakness, our management, including our CEO and CFO, has concluded that our Consolidated Financial Statements included in our 2019 Form 10-K and the Condensed Consolidated Financial Statements included in this Report are fairly stated in all material respects in accordance with GAAP for each of the periods presented, and that they can still be relied upon. 31 Material Weaknesses in Internal Control Over Financial Reporting We identified the following control deficiency that constituted a material weakness in our internal control over financial reporting as of December 31, 2019 and 2018 which has been fully remediated as of September 30, 2020. • We did not design and maintain effective controls over user access within the Company’s ERP system, Oracle, to ensure appropriate segregation of duties and to adequately restrict user access to appropriate personnel. Specifically, the provisioning and user recertification controls were not designed to ensure that users maintain proper segregation of duties and, as a result, users could have had inappropriate access rights (the “Access Control Weakness”). We identified the following control deficiency that constituted a material weakness in our internal control over financial reporting as of September 30, 2020 and December 31, 2019 and 2018. • We did not design and maintain effective controls over the completeness and accuracy of information included in key spreadsheets supporting our accounting records (the “Spreadsheet Control Weakness”). These control deficiencies constituted material weaknesses, but did not result in a material misstatement to our annual or interim consolidated financial statements. However, if the remaining material weakness is not remediated, a material misstatement of account balances or disclosures may not be prevented, and may go undetected, which could result in a material misstatement of future annual or interim consolidated financial statements. Remediation Efforts to Address Material Weaknesses Beginning December 31, 2019, we commenced developing and implementing a plan to enhance the design and operating effectiveness of our internal control over financial reporting, which includes taking the following steps to remediate the identified control deficiencies and material weaknesses: • To address the Access Control Weakness, we utilized the services of an Oracle consulting firm and an accounting firm unrelated to our Independent Registered Accounting Firm, to assist us in analyzing and reviewing Oracle access for all users. During the first quarter of 2020, we completed the analysis and deployed an action plan. Based on this analysis and action plan, during the second quarter of 2020, we created new Oracle responsibilities for each employee for which a conflict was identified to remove Oracle transactional responsibilities that we believed to be conflicting and reassigned those responsibilities to a different employee to ensure proper segregation of duties. We completed the implementation of the new Oracle responsibilities for all users in July 2020. During the third quarter of 2020, we completed the enhancement and implementation provisioning and user certification controls to ensure we maintain the appropriate segregation of duties within Oracle. The Access Control Weakness was deemed to be remediated as of September 30, 2020. • To address the Spreadsheet Control Weakness, for each key spreadsheet we plan to evaluate and determine (1) if a standard Oracle report exists containing the same information as the spreadsheet, and if so, we would utilize the standard Oracle report (without modification) instead of the spreadsheet to support our accounting records and (2) if a standard Oracle report cannot be used, we will implement a new key control whereby an employee performs a formal validation that the information from Oracle is completely and accurately transferred (automatically or manually) to a spreadsheet by verifying totals and other information on a test basis. For all key spreadsheets, we plan to design and implement a new key control to validate the completeness and accuracy of information supporting our accounting records. During the first nine months of 2020, we began the process of evaluating each key spreadsheet based on the above criteria, and for several key spreadsheets, we implemented a new key control to validate the completeness and accuracy of the information contained within and supporting each such spreadsheet. Changes in Internal Control Over Financial Reporting Other than the changes intended to remediate the material weakness noted above, no change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the three months ended September 30, 2020 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. 32 PART II. OTHER INFORMATION