What changed in this filing

/stocks — the workspaceLOADING

Item 9A. Controls and Procedures

2026-03-02 compared with 2025-03-06 · 35 added, 68 removed, 210 unchanged (33% of the section changed)

Controls and Procedures

Previously Disclosed Material Weakness Related to IT Controls

As previously reported in the 10K filing for year-end December 31, 2023, the Company did not design and maintain effective internal controls related to our information technology general controls (“ITGCs”) in the areas of user access and program change-management over certain information technology (“IT”) systems that support the Company’s financial reporting processes.

Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

We believe that these control deficiencies were a result of:

IT control processes lacking sufficient documentation such that the successful operation of ITGCs was overly dependent upon knowledge and actions of certain individuals with IT expertise and inherent system limitations.

The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results.

Disclosure Controls and Procedures

As of December 31, 2024, the Company’s management, with participation of the Company’s President and Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), evaluated the effectiveness of the Company’s disclosure controls and procedures as defined in Exchange Act Rules 13a-15(e) and 15d-15(e).

Based on that evaluation, the CEO and CFO concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2024, solely due to the previously disclosed material weaknesses related to ITGCs in the areas of user access and program change-management over certain IT systems that support the Company’s financial reporting processes.

No financial restatements were made as a result of this material weakness.

Internal Control

Pursuant to Section 404 of the Sarbanes-Oxley Act of 2002, we have included a report that provides management’s assessment of our internal control over financial reporting as part of this Annual Report on Form 10-K for the year ended December 31, 2024.

Management’s report is included below under the caption entitled “Management’s Report on Internal Control Over Financial Reporting,” and is incorporated herein by reference.

As required by Rule 13a-15(b) under the Exchange Act, our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, has performed an assessment of the effectiveness of our disclosure controls and procedures, as that term is defined in Rules 13a-15(e) of the Exchange Act, as of the end of the period covered by this Annual Report.

Based on that assessment, our management has concluded that our disclosure controls and procedures were effective as of December 31, 2025 to provide reasonable assurance that information required to be disclosed by us in reports filed or submitted under the Exchange Act is (1) recorded, processed, summarized and reported within the time periods specified in the SEC rules and forms and (2) accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Management ’ s Report on Internal Control over Financial Reporting

The consolidated financial statements appearing in this Annual Report have been prepared by the management that is responsible for their preparation, integrity, and fair presentation and reviewed by the Audit Committee of the Board of Directors.

The statements have been prepared in accordance with U.S.

generally accepted accounting principles, which requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Securities Exchange Act of 1934, as amended).

Our internal control system was designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

All internal control systems, no matter how well designed, have inherent limitations.

Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Further, because of changes in conditions over the normal and routine course of business, the effectiveness of an internal control system may vary over time.

With the oversight of the Audit Committee of the Board of Directors, and under the supervision and with the participation of our management, including our CEO and CFO, we conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2024, based on the standardized framework in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (“COSO ICIF”).

According to this standard, a material weakness is defined as a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Based on our evaluation under the framework in COSO ICIF, our management concluded that our internal control over financial reporting was not effective as of December 31, 2024, which was previously reported.

The material weakness did not require a financial restatement.

Internal Controls Related to Information Technology and User Access

While we designed and implemented internal controls related to our ITGCs in the areas of user access and program change-management over certain IT systems that support the Company’s financial reporting processes, we did not maintain those controls for a sufficient period of time to effectively demonstrate the operating effectiveness of those ITGCs.

Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

We believe that these control deficiencies were a result of ITGCs overly dependent upon knowledge and actions of certain individuals with IT expertise and inherent system limitations creating segregation of duties risks for most of the fiscal year.

Our independent registered public accounting firm has audited the consolidated financial statements appearing in this Annual Report and the effectiveness of our internal controls over financial reporting and has issued their reports, included herein.

Notwithstanding the above identified material weakness, management believes the financial statements as included in Part II of this Annual Report on Form 10-K fairly represent in all material respects the Company’s financial condition, results of operations and cash flows as of and for the periods presented in accordance with generally accepted accounting principles in the U.S.

Remediation Plan

In 2024, we have been engaged in the implementation of a new enterprise resource planning (“ERP”) system, which is part of the remediation efforts for our material weakness in internal controls over financial reporting identified.

This ERP system will replace our operating and financial systems and is designed to accurately maintain the Company’s financial records, enhance operational functionality and provide timely information to the Company’s management team related to the operation of the business.

While we have taken meaningful steps to improve our internal controls, full remediation of the previously identified material weakness was not realized as of December 31, 2024.

We anticipate that the remediation will be complete by the end of fiscal year 2025, as at that time the referenced controls will have been in place for a sufficient period of time to demonstrate operating effectiveness.

The Company implemented the following remediation control activities in 2024:

Enhanced policies and procedures to improve our overall control environment, including processes for reporting deficiencies to those parties responsible for taking corrective action, such as senior management and the Board of Directors, as appropriate.

Recruited key positions within our technology, accounting, and other support functions with appropriate qualified experience to 1) enhance our risk assessment processes and internal control activities;

2) allow for additional segregation of duties and improved change management;

and 3) provide appropriate oversight and reviews.

Provided training and education programs for personnel responsible for the performance of key IT controls and business processes throughout the Company to facilitate their understanding of the risks being addressed by the controls they are performing, as well as educate them in the documentation requirements of the internal control framework.

Made investments in our technology platforms and associated monitoring tools, in order to provide better reporting capabilities and allow for transparency as to the changes made by users with privileged access.

We also implemented monitoring controls utilizing these tools to validate that activities performed by those accounts were authorized and appropriate.

Modified and restricted access to key system privileges to minimize segregation of duties risks within the Company and its IT systems.

Made significant progress in enhancements to the business process control environment to address the noted design deficiencies.

Increased resource allocations to further support the internal controls compliance program.

While we have put forth significant resources and effort in our remediation activities described above, ongoing and additional activities are required to fully remediate our material weaknesses.

Our ongoing efforts include:

Anticipated completion of the implementation of the new ERP system in the first half of 2025 providing an enhanced control environment.

Continue to utilize third-party consultants specialized in ITGC’s, internal audit, risk management and compliance functions.

Their expertise will help us to continually assess risk and design and implement appropriate controls to address said risks.

Continuing to implement and enhance ITGCs and related policies.

Continuing to configure system access and new tools, such as monitoring software, to allow us to better report upon and evaluate software modifications, data changes, and other relevant IT changes.

Providing additional training for control owners and reviewers with specific focus on understanding the risks being addressed by the controls they are performing, as well as requirements for sufficient documentation and evidence in the execution of the controls.

Continuing to enhance our reporting process related to the remediation measures to the Audit Committee of the Board of Directors.

Upon the completion of the steps above, we believe that these actions will remediate the material weakness.

However, the material weakness will not be considered fully remediated until the applicable controls have been in place for a sufficient period of time, and management has concluded, through testing, that these controls are operating effectively.

Role of the Audit Committee in Material Weakness Remediation

The Audit Committee of the Board of Directors is actively overseeing the remediation of the material weaknesses.

Working closely with management, as well as with the Company’s internal audit, finance teams, and independent auditors, the Audit Committee has and will continue to monitor and evaluate the effectiveness of the remediation throughout the fiscal year ending December 31, 2025.

Regular updates on progress have been and will continue to be provided to the Board of Directors, with the Audit Committee ensuring management’s testing of the remediated controls is completed as soon as practicable

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Securities Act.

Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of our consolidated financial statements for external reporting purposes in accordance with GAAP.

Our internal control over financial reporting includes policies and procedures that:

(1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets;

(2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of consolidated financial statements in accordance with GAAP;

(3) provide reasonable assurance that our receipts and expenditures are being made only in accordance with authorizations of our management and directors;

and (4) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the consolidated financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.

Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, conducted an assessment of the effectiveness of internal control over financial reporting as of December 31, 2025 based on the 2013 Internal Control — Integrated Framework (the “COSO Framework”) issued by the Committee of Sponsoring Organizations (COSO).

Based on this assessment under the COSO Framework, our management has concluded that our internal control over financial reporting was effective as of December 31, 2025.

Attestation report of the registered public accounting firm

Our independent registered public accounting firm has audited the consolidated financial statements included in this Annual Report, and as part of their audit, has issued their report, included herein, on the effectiveness of our internal control over financial reporting as of December 31, 2025.

Their report is included beginning on page F-[ ] of this Annual Report.

Remediation of Previous Material Weakness

We previously identified a material weakness in our internal control over financial reporting, which was remediated during 2025.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

As previously disclosed, management identified a material weakness in internal control over financial reporting related to ineffective information technology general controls (“ITGCs”) in the areas of user access and program change management over certain information technology systems that support the Company’s financial reporting processes.

During 2025, management implemented and tested remediation measures designed to address the control deficiencies.

These measures included enhancing user access review controls, adding new personnel, implementing additional monitoring activities, and providing supplemental training to relevant personnel.

Management completed its testing of the design and operating effectiveness of these controls during 2025.

Based on the successful implementation and testing of these remediation efforts, management concluded that the previously identified material weakness was remediated as of December 31, 2025.

Changes in Internal Controls over Financial Reporting

Other than in connection with aspects of our remediation plan, there were no changes in the Company’s internal controls over financial reporting during the fiscal quarter ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other than as noted above in connection with the remediation of the previously identified material weakness, management has determined that there were no changes in the Company’s internal controls over financial reporting during the fiscal quarter ended December 31, 2025 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

Other Information

36 unchanged sentences

Indenture dated as of February 19, 2025, between Turning Point Brands, Inc.

and GLAS Trust Company LLC (including the form of Note as Exhibit A thereto).*

and GLAS Trust Company LLC (incorporated by reference to Exhibit 4.3 to the Registrant's Annual Report on Form 10-K filed on March 6,2025).

Turning Point Brands, Inc.

111 unchanged sentences

333-207816) filed on November 24, 2015).

Employment Agreement by and between the Company and Andrew Flynn, dated as of March 6, 2024.†*

Pledge and Security Agreement, dated as of February 19, 2025, by and among the Company, the other grantors party thereto and GLAS Trust Company LLC, as collateral agent.*

Patent Security Agreement, dated as of February 19, 2025, by and among the grantors party thereto and GLAS Trust Company LLC.*

Securities Trading Policy.*

Employment Agreement by and between the Company and Andrew Flynn, dated as of March 6, 2024 (incorporated by reference to Exhibit 10.33 to the Registrant's Annual Report on Form 10-K filed on March 6, 2025).†

Pledge and Security Agreement, dated as of February 19, 2025, by and among the Company, the other grantors party thereto and GLAS Trust Company LLC, as collateral agent (incorporated by reference to Exhibit 10.34 to the Registrant's Annual Report on Form 10-K filed on March 6, 2025).

Patent Security Agreement, dated as of February 19, 2025, by and among the grantors party thereto and GLAS Trust Company LLC (incorporated by reference to Exhibit 10.35 to the Registrant's Annual Report on Form 10-K filed on March 6, 2025).

Securities Trading Policy (incorporated by reference to Exhibit 19.1 to the Registrant's Annual Report on Form 10-K filed on March 6, 2025).

Subsidiaries of Turning Point Brands, Inc.*

Consent of RSM US LLP*

Consent of KPMG LLP*

Certification of Principal Executive Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002*

2 unchanged sentences

Certifications of Principal Executive Officer and Principal Financial Officer pursuant to 18 U.S.C.

Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.*

Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 (incorporated by reference to Exhibit 32.1 to the Registrant's Annual Report Form 10-K filed on March 6, 2025).

Clawback policy of Turning Point Brands, Inc.

42 unchanged sentences

March 2, 2026

/s/ Kathleen Shanahan

March 2, 2026

Kathleen Shanahan

/s/ Stephen Usher

4 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 9A. Controls and Procedures