Turning Point Brands, Inc. 10-Q

Item 4. Controls and Procedures We have carried out an evaluation under the supervision, and with the participation of, our management including our Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”), and Chief Accounting Officer (“CAO”), of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act of 1934, as amended as of September 30, 2023. Based upon the evaluation, our CEO, CFO, and CAO concluded our disclosure controls and procedures are not effective as of such date solely due to material weaknesses in internal controls over financial reporting that were disclosed in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022. As previously described in Part II, Item 9A of our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, during our evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2022, we concluded that our internal control over financial reporting was not effective solely due to the existence of the following material weaknesses: we did not design and maintain effective internal controls related to our information technology general controls (“ITGCs”) in the areas of user access and program change-management over certain information technology systems that support the Company’s financial reporting processes. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We also did not appropriately design and operate controls associated with the risk assessment component of the internal control framework, specifically as it relates to identifying risks around segregation of duties within the financial reporting function, and the identification of all risks relating to the financial statements and controls that would address such risks. This impacts business process controls (automated and manual) throughout financial reporting and the business transaction cycles. The material weaknesses did not result in any identified misstatements to our financial statements, and there were no changes to previously released financial results. The material weaknesses will not be considered remediated until the applicable controls operate for a sufficient period of time, and management has concluded through testing that these controls are operating effectively. During the nine months ended September 30, 2023, we have continued to make progress on our remediation plans to address the material weaknesses in the Company’s internal controls over financial reporting. These remediation efforts include hiring additional experienced accounting and internal control specialists and external consultants. In addition, the Company is in process of redesigning key controls for both business processes and information technology controls along with implementing a new enterprise resource planning system. 49 Table of Contents PART II—OTHER INFORMATION