TANDY LEATHER FACTORY INC 10-K

ITEM 9A. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures As part of the filing of this Form 10-K for the period ended December 31, 2021, our management, with the participation of our Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), evaluated the effectiveness of the design and operation of our disclosure controls and procedures as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). As a result of this evaluation, our CEO and CFO concluded that our disclosure controls and procedures were not effective due to the material weaknesses described below. Management’s Annual Report on Internal Control over Financial Reporting Our management, including our CEO and CFO, is responsible for establishing and maintaining adequate internal control over our financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Management’s establishing and maintaining adequate internal control over financial reporting is based upon the criteria established in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (the “COSO Framework”). A system of internal control over financial reporting should be designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. An effective internal control system, no matter how well designed, has inherent limitations, including the possibility of human error, the circumvention or overriding of controls, or fraud, and therefore can provide only reasonable assurance with respect to reliable financial reporting. Because of its inherent limitations, our internal control over financial reporting may not prevent or detect all misstatements. A material weakness is defined as a deficiency, or combination of deficiencies in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. Based on this definition, our management, with the participation of our CEO and CFO, evaluated the effectiveness and design of our internal control over financial reporting against the COSO Framework and concluded that our internal control over financial reporting was not effective as of December 31, 2021 due to material weaknesses arising from flaws in our control environment, risk oversight measures, control activities, information processing and communication and our monitoring systems, each of which is described in more detail below. Control environment. We concluded that we did not maintain effective controls in the following areas: (i) managerial functions, procedures and oversight; (ii) organizational structure, delegation of authority and responsibilities; (iii) segregation of duties; (iv) adequacy of trained accounting and financial reporting personnel to ensure that internal control responsibilities were performed effectively and material accounting errors were detected; and (v) maintenance and enforcement of internal control responsibilities, including holding individuals accountable for their internal control responsibilities. 56 Table of Contents Risk oversight environment. We did not maintain adequate risk oversight measures related to the (i) identification and assessment of risks that could impact achieving our objectives and (ii) identification and analysis of the potential changes that could affect our internal controls environment. Control activities. We concluded that we did not have effective control activities in the following areas: (i) selecting and developing control activities to mitigate risks, including the development of alternative control activities that address segregation of duties issues; (ii) selecting and implementing information technology and related systems supportive to our internal control over financial reporting; and (iii) deploying control activities through policies and establishing procedures that put these policies into action, including timely review of account reconciliations and methodologies used to calculate and report financial information and results, as well as timely periodic management reviews of financial information and results that would help identify misstatements. Information and communication. We identified deficiencies associated with information and communication within our internal control framework. Specifically, we did not effectively assign responsibility to personnel for gathering required information nor did we periodically communicate objectives and internal control responsibilities throughout the organization which contributed to inadequate documentation of processes, untimely review of account reconciliations and calculations involving judgement and delays in the accounting close cycle, hindering timely communication with management, the Board of Directors and our independent auditors. Monitoring activities . We concluded that we did not design and implement effective monitoring activities related to (i) selecting, developing, and performing separate evaluations of our internal control over financial reporting; and (ii) evaluating and communicating internal control deficiencies in a timely manner to parties responsible for taking corrective actions. Remediation Efforts to Address Material Weaknesses Our management, including our CEO and CFO, continue to work with expert accounting consultants and our Audit Committee to design and implement both a short-term and a long-term remediation plan to correct the material weaknesses in our disclosure controls and procedures and our internal control over financial reporting. The following activities highlight our commitment to remediating our identified material weaknesses: During 2020, 2021 and through the filing date of this Form 10-K, we have taken the following measures, among others: i. Replaced critical roles within our accounting team with contract accounting resources and continue to search for full-time employees with expertise in GAAP accounting, SEC reporting and disclosure, internal audit and internal controls; ii. Replaced our legacy accounting systems with an integrated enterprise resource planning (“ERP”) solution which includes general ledger, warehouse management and factory production modules designed to calculate inventory on a FIFO basis; iii. Implemented a new point-of-sale system for 94 U.S. stores that is fully integrated with our new ERP system (the remaining 12 stores will be converted during the remainder of 2022); iv. Created a risk controls matrix which includes, among other things, a comprehensive list of key and mitigating controls, a description of the risk the control is designed to mitigate, the individual responsible for each control, the frequency in which the control is performed, and a mapping of each control to the five COSO Framework components (control environment, risk assessment, control activities, information and communication, or monitoring activities); v. Established a greater sense of accountability by requiring sub-certifications below the CEO and CFO level for certain key accounting, finance and operations personnel. 57 Table of Contents Our continuing plan and additional steps for remediation include: i. Ongoing recruitment and hiring of permanent, qualified public-company accounting personnel; ii. Converting the remaining 12 stores onto our new point-of-sale system; iii. Redesigning our accounting procedures and activities to align with our new ERP system that will include built-in controls to improve upon the reliability of financial reporting and the preparation of financial statements in accordance with GAAP; iv. Continuing to improve the accounting close process, including periodic review and update of our accounting close checklists for completeness of duties, accuracy of owners and deadlines to maintain accountability, timely review of account reconciliations and calculations involving judgement, and timely reporting of financial results; v. Updating process narrative documentation in the following areas: (i) financial reporting, (ii) inventory, (iii) purchasing and accounts payable, (iv) revenue, (v) fixed assets and lease accounting, (vi) general accounting, treasury and financial planning & analysis, (vii) tax, (viii) information technology (IT) governance, and (ix) HR and payroll; vi. Periodically reviewing of our risk controls matrix and process narrative documentation to ensure changes such as personnel, information sources, processes, systems, and frequency in performing the control are properly reflected in a timely manner; vii. Reporting the progress and results of our remediation plan to the Audit Committee on a recurring basis, including the identification, status, and resolution of internal control deficiencies; and viii. Creating a comprehensive approach to regularly evaluate the operating effectiveness of our disclosure controls and procedures and our internal control over financial reporting using the COSO Framework as a guide. Control Environment Our management, including our CEO and CFO, our Audit Committee and our Board of Directors have taken certain steps to set the proper tone-at-the-top in support of the Company’s values and climate to develop and maintain an effective internal control environment. These actions include: ■ Recurring meetings with leadership, finance and accounting and other key functional areas to train staff on processes for oversight and emphasize each individual’s accountability for internal control compliance, and to create a pattern of regular discussion of such controls. ■ Periodic communications from the CEO, CFO and other key senior leaders on the Company’s mission, core values, Code of Business Conduct and Ethics, whistleblower policies, and each employee’s individual responsibility for internal control compliance. ■ Reorganization of the finance and accounting team to address segregation of duties issues, oversight and review of work, and recruiting and hiring qualified, competent employees with relevant experience for the roles. ■ Regular performance evaluations to include position-specific criteria for functional competence, including performance of internal control responsibilities. Risk Oversight Measures We continue to identify risks and enhance risk oversight measures. In late 2019, we developed an annual strategic planning process designed to identify specific operating objectives for the organization and to conduct an assessment across the organization of the risks to meeting those objectives, including the risk of fraud. Furthermore, on a quarterly basis, management will review our periodic filings to ensure that identified risks have been appropriately disclosed. In the areas of reporting and compliance objectives, we are also developing a process to conduct monthly business reviews by functional area that would include risk assessments of reporting accuracy based on complexity and transaction levels as well as compliance with GAAP and other regulatory requirements, in order to evaluate whether our existing control activities appropriately mitigate such risks or if additional controls need to be employed. 58 Table of Contents Control Activities We continue to redesign and implement our internal control activities. Specifically, we are conducting detailed working sessions to document our current and prior finance and accounting policies, procedures and step-by-step activities. These sessions are expected to identify specific areas that require improvement and redesign of processes, structure, authorities and controls, and those actions include: ■ Completing the implementation of our new point-of-sale system, which is fully integrated with our ERP system, for our remaining 12 stores during the remainder of 2022. ■ Continuing to implement functionality in our ERP system to improve on our internal controls over financial reporting, such as implementing the ERP’s bank reconciliation module. ■ Creating and implementing newly-designed processes, structures, delegation of authority and controls, in accordance with the COSO Framework, including: o Quarterly updates for the CFO regarding upcoming accounting pronouncement and proposed changes to GAAP accounting standards, tax regulations, and other requirements that may impact the Company’s financial reporting; o Timely reviews each quarter of the most significant accounting estimates and judgements; o Validation of results through detailed variance analyses and reconciliation of account balances performed on a timely basis; o Monthly business review of actual financial performance compared to forecasts with participation from leadership across the organization; and o Establishing a disclosure committee comprised of key management throughout the different areas of the organization to evaluate the appropriateness of disclosures in the Company’s periodic filings on Forms 10-K and 10-Q and to support the CEO and CFO with the certification process. Information Processing and Communication The implementation of our new ERP system eliminated the need for the topside adjustment calculations that had to be performed because our legacy systems were not integrated and many of our accounting processes were manual. This new ERP system allows us to automate certain accounting processes, reducing the risk of management override, and eliminated the need for topside adjustments outside of the system. In addition, management is developing detailed policies, procedures and internal controls related to our financial reporting and working to develop regular reporting from our new systems that can validate the quality of our data and provide accurate information to support internal and external reporting and audit requirements. Monitoring Activities In addition to the items noted above, as we continue to evaluate, remediate, and improve our internal control over financial reporting, our management expects to continue to implement additional measures to address control deficiencies and further refine and improve the remediation efforts described above. Specifically, we are developing a checklist of activities based on the criteria established in the COSO Framework against which we will assess the design of entity-level and activity-level controls, and the operational effectiveness of such controls. Deficiencies identified in this process will be addressed by management, including our CEO and CFO. This assessment, any deficiencies and any remedial actions will be shared and discussed with our Audit Committee and our independent auditors on a quarterly basis. 59 Table of Contents Cybersecurity We utilize information technology for internal and external communications with vendors, customers and banks as well as systems technology for reporting and managing our operations. Loss, disruption or compromise of these systems could significantly impact operations and results. Other than temporary disruption to operations that may be caused by a cybersecurity breach, we believe cash transactions to be the primary risk for potential loss. We work with our financial institutions to take steps to minimize the risk by requiring multiple levels of authorization, encryption and other controls. The Company utilizes third party intrusion prevention and detection systems and performs periodic penetration testing to monitor its cybersecurity environment. However, the Company has not performed a formalized risk assessment to address cybersecurity risks or documented internal controls that assist in alleviating such risks. Changes in Internal Control Over Financial Reporting As discussed in the remediation section above, we implemented the warehouse management, factory production system and general ledger systems modules as part of our new ERP system implementation which had a go-live date of September 1, 2020, and we implemented our new point-of-sale system, which is fully integrated with our ERP system, in 94 of our U.S. stores with the remaining 12 stores to be converted during the remainder of 2022. Although we had not fully remediated all material weaknesses in our internal control over financial reporting as of December 31, 2021, as the phased implementation of this system continues, we are experiencing certain changes to our processes and procedures which, in turn, result in changes to our internal control over financial reporting. While we expect our new ERP system to strengthen our internal financial controls by automating certain manual processes and standardizing business processes and reporting across our organization, management will continue to evaluate and monitor our internal controls as each of the affected areas evolves. ITEM 9B. OTHER INFORMATION None. 60 Table of Contents PART III ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE* ITEM 11. EXECUTIVE COMPENSATION* ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS* ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS, AND DIRECTOR INDEPENDENCE* ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES* * The information required by Items 10, 11, 12, 13, and 14 is or will be set forth in the definitive proxy statement relating to the 2022 Annual Meeting of Stockholders of Tandy Leather Factory, Inc., which is to be filed with the Securities and Exchange Commission pursuant to Regulation 14A under the Securities Exchange Act of 1934, as amended. This definitive proxy statement relates to a meeting of stockholders involving the election of directors and the portions therefrom required to be set forth in this Form 10-K by Items 10, 11, 12, 13, and 14 are incorporated herein by reference pursuant to General Instruction G(3) to Form 10-K. 61 Table of Contents PART IV ITEM 15. EXHIBITS, FINANCIAL STATEMENT SCHEDULES (a) The following are filed as part of this Form 10-K: 1. Financial Statements The following Consolidated Financial Statements are included in Item 8, Financial Statements and Supplementary Data: • Report of Independent Registered Public Accounting Firm (PCAOB ID Number 410 ) • Consolidated Balance Sheets as of December 31, 2021 and 2020 • Consolidated Statements of Comprehensive Income (Loss) for the years ended December 31, 2021 and 2020 • Consolidated Statements of Cash Flows for the years ended December 31, 2021 and 2020 • Consolidated Statements of Stockholders’ Equity for the years ended December 31, 2021 and 2020 2. Financial Statement Schedules All financial statement schedules are omitted because the required information is not present or not present in sufficient amounts to require submission of the schedule or because the information is reflected in the Consolidated Financial Statements or notes thereto. 62 Table of Contents 3. Exhibits TANDY LEATHER FACTORY, INC. AND SUBSIDIARIES EXHIBIT INDEX Exhibit Number Description 3.1 Certificate of Incorporation of The Leather Factory, Inc., and Certificate of Amendment to Certificate of Incorporation of The Leather Factory, Inc. filed as Exhibit 3.1 to Tandy Leather Factory, Inc.’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on August 12, 2005 and incorporated by reference herein. 3.2 Bylaws of Tandy Leather Factory, Inc., filed as Exhibit 3.1 to Tandy Leather Factory, Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on December 8, 2021 and incorporated by reference herein. 3.3 Certificate of Designations of Series A Junior Participating Preferred Stock of Tandy Leather Factory, Inc. filed as Exhibit 3.1 to Tandy Leather Factory, Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on June 10, 2013 and incorporated by reference herein. 4.1 Description of Securities filed as Exhibit 4.1 to Tandy Leather Factory, Inc.’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on June 22, 2021 and incorporated by reference herein. 10.1 Tandy Leather Factory, Inc. 2013 Restricted Stock Plan, filed as Exhibit 10.1 to Tandy Leather Factory’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on November 14, 2013 and incorporated by reference herein. 10.2 Amendment #1 to Tandy Leather Factory, Inc. 2013 Restricted Stock Plan filed as Exhibit 10.5 to Tandy Leather Factory, Inc.’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on June 22, 2021 and incorporated by reference herein. 10.3 Form of Non-Employee Director Restricted Stock Agreement under Tandy Leather Factory, Inc.’s 2013 Restricted Stock Plan, filed as Exhibit 10.1 to Tandy Leather Factory, Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on February 14, 2014 and incorporated by reference herein. 10.4 Form of Employee Restricted Stock Award Agreement under Tandy Leather Factory, Inc.’s 2013 Restricted Stock Plan, filed as Exhibit 10.7 to Tandy Leather Factory, Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on February 14, 2014 and incorporated by reference herein. 10.5 Form of Employment Agreement dated October 2, 2018 between the Company and Janet Carr, filed as Exhibit 10.1 to Tandy Leather Factory Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on October 5, 2018 and incorporated by reference herein. 10.6 Form of Stand-Alone Restricted Stock Unit Agreement dated October 2, 2018 between the Company and Janet Carr, filed as Exhibit 10.2 to Tandy Leather Factory Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on October 5, 2018 and incorporated by reference herein. 63 Table of Contents 10.7 Form of Stand-Alone Restricted Stock Unit Agreement dated October 2, 2018 between the Company and Janet Carr, filed as Exhibit 10.3 to Tandy Leather Factory Inc.’s Current Report on Form 8-K filed with the Securities and Exchange Commission on October 5, 2018 and incorporated by reference herein. 10.8 Form of Stock Purchase Agreement dated January 28, 2021 between the Company and Central Square Management, filed as Exhibit 10.14 to the Tandy Leather Factory, Inc.’s 2019 Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on June 22, 2021 and incorporated by reference herein. *10.9 Form of Stock Purchase Agreement dated December 8, 2021 between the Company and Right Lane I, LP. 14.1 Code of Business Conduct and Ethics of Tandy Leather Factory, Inc., adopted by the Board of Directors on December 4, 2018, filed as Exhibit 14.1 to Tandy Leather Factory, Inc.’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on June 22, 2021 and incorporated by reference herein. *21.1 Subsidiaries of Tandy Leather Factory, Inc. *23.1 Consent of Independent Registered Public Accounting Firm. *31.1 Certification by the Chief Executive Officer and President pursuant to Rule 13a-14(a) or 15d-14(a) under the Securities Exchange Act of 1934, as amended. *31.2 Certification by the Chief Financial Officer pursuant to Rule 13a-14(a) or 15d-14(a) under the Securities Exchange Act of 1934, as amended. *32.1 Certification Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002. *101.INS XBRL Instance Document. *101.SCH XBRL Taxonomy Extension Schema Document. *101.CAL XBRL Taxonomy Extension Calculation Document. *101.DEF XBRL Taxonomy Extension Definition Document. *101.LAB XBRL Taxonomy Extension Labels Document. *101.PRE XBRL Taxonomy Extension Presentation Document. __________ *Filed Herewith 64 Table of Contents ITEM 16. FORM 10-K SUMMARY None. 65 Table of Contents SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, as amended, the Registrant has duly caused this Form 10-K to be signed on its behalf by the undersigned, thereunto duly authorized. TANDY LEATHER FACTORY, INC. By: /s/ Janet Carr Janet Carr Chief Executive Officer Dated: March 31, 2022 Pursuant to the requirements of the Securities Exchange Act of 1934 as amended, this Report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated. Signature Title Date /s/ Jefferson Gramm Chairman of the Board March 31, 2022 Jefferson Gramm /s/ Janet Carr Chief Executive Officer, Director March 31, 2022 Janet Carr (principal executive officer) /s/ Michael Galvan Chief Financial Officer March 31, 2022 Michael Galvan (principal financial officer and principal accounting officer) /s/ William M. Warren Director March 31, 2022 William M. Warren /s/ James Pappas Director March 31, 2022 James Pappas /s/ Vicki Cantrell Director March 31, 2022 Vicki Cantrell /s/ Sharon M. Leite Director March 31, 2022 Sharon M. Leite /s/ Sejal Patel Director March 31, 2022 Sejal Patel /s/ Elaine D. Crowley Director March 31, 2022 Elaine D. Crowley