FIRST INTERSTATE BANCSYSTEM INC

Item 4.

CONTROLS AND PROCEDURES

Disclosure Controls and Procedures

Our management, under the supervision and with the participation of the Chief Executive Officer (who is our principal executive officer) and Chief Financial Officer (who is our principal financial officer), evaluated the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of March 31, 2024. The term "disclosure controls and procedures" means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the issuer's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that as of March 31, 2024, our disclosure controls and procedures were effective in ensuring that information required to be disclosed by us in reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods required by the SEC’s rules and forms and is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Our management, including the Chief Executive Officer and Chief Financial Officer, assessed the effectiveness of our internal control over financial reporting as of March 31, 2024, based on the criteria and guidelines established in the Internal Control--Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on such assessment, management determined that the Company’s internal control over financial reporting was not effective as of March 31, 2024 due to the un-remediated material weaknesses in internal control over financial reporting related to the aggregated controls over the establishment of new deposit accounts, segregation of duties over the establishment of new loan accounts and the maintenance of loan and deposit accounts, and certain information technology general controls specific to logical access and change management, which was previously disclosed in the Company's Annual Report on Form 10-K for the year ended December 31, 2023. Prior to the filing of this Quarterly Report on Form 10-Q (this “Form 10-Q”), we completed procedures for the quarter ended March 31, 2024. Based on these procedures, management believes that our Condensed Consolidated Financial Statements included in this Form 10-Q have been prepared in accordance with GAAP. For additional information, please refer to Part II - Item 9A of the Company's Annual Report on Form 10-K for the year ended December 31, 2023.

Remediation

Management is in process of implementing measures designed to ensure that the aggregated control deficiencies contributing to the material weaknesses are remediated, such that these controls are designed, implemented, and operating effectively. The following remediation actions have been completed: (i) the inclusion of all relevant fields to financial reporting within the scope of the new deposit account quality assurance review, (ii) revision of the sampling procedures for the new deposit account quality assurance review to achieve additional precision and document the rationale for the scope of the sampling approach based on acceptable exception rates, (iii) removal of the ability of an employee to edit relevant ‘keyword’ fields in the workflow system, which was a vulnerability in the segregation of duties configuration, and (iv) review of the workflow system logs, which commenced during 2023, to identify any potential instances of unauthorized changes to keywords and investigate instances of segregation of duties violations, if any, related to deposit account maintenance and loan boarding and maintenance activity. We validated that no unauthorized changes or violations occurred. Additional remediation actions will include: (i) implementation of a quality assurance process to add another layer of control prior to the finalization of each period's user access review(s) and enhancement of written procedures for obtaining complete and accurate populations of user access reviews for each system with a manual population, (ii) modification of the timing of annual user access reviews, (iii) enhancement of segregation of duties in change management by migrating to an automated alternate cloud solution, (iv) identification of data transfers between systems specifically impacting the Company’s internal control over financial reporting, which began in 2023, and (v) enhancement of logging and monitoring activities to demonstrate the effective execution of the data transfers control. We believe that as certain identified actions are implemented, we will be able to remediate the aggregation of control deficiencies that resulted in a material weaknesses. The material weaknesses will not be considered remediated; however, until the identified controls operate for a sufficient period and management has concluded, through testing, that these controls are operating effectively.

We expect that the remediation of the aggregated control deficiencies that resulted in a material weakness will be completed during 2024.

Changes in Internal Control Over Financial Reporting

Other than the ongoing remediation efforts described above, there were no changes in our internal control over financial reporting for the quarter ended March 31, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Controls and Procedures

The effectiveness of our disclosure controls and procedures and our internal control over financial reporting is subject to various inherent limitations, including cost limitations, judgments used in decision making, assumptions about the likelihood of future events, the soundness of our systems, the possibility of human error, and the risk of fraud. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions and the risk that the degree of compliance with policies or procedures may deteriorate over time. Because of these limitations, any system of disclosure controls and procedures or internal control over financial reporting may not be successful in preventing all errors or fraud or in making all material information known in a timely manner to the appropriate levels of management.