Canopy Growth Corp

Evaluation of Disclosure Controls and Procedures.

We maintain disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, and summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures. Any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. An evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this Quarterly Report was made under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer.

Based upon this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of December 31, 2023, our disclosure controls and procedures were not effective as of such date due to the material weakness in our internal control over financial reporting related to information technology ("IT") general controls that were disclosed in Item 9A of the Annual Report.

Previously Reported Material Weaknesses

As previously disclosed in Item 9A of the Annual Report, we previously identified material weaknesses in our internal control over financial reporting relating to:

•

The accounting for sales recorded by the BioSteel segment, which resulted in material misstatements relating to revenue and trade receivables, particularly with respect to the timing and amount of revenue recognition. Specifically, we did not design and maintain effective controls to sufficiently assess the timing, amount, and appropriateness of revenue recognition. This included a lack of segregation of duties in the review of customer orders, inadequate controls over the review and approval of sales returns, and inadequate controls relating to revenue recognition policies and procedures. This also contributed to the failure to impair goodwill related to the BioSteel reporting unit on a timely basis as changes in the performance of BioSteel were not identified in a timely manner, and the failure to accurately record the redeemable noncontrolling interest; and

•

IT general control deficiencies that aggregated to a material weakness. These deficiencies specifically related to: (i) logical access management, including untimely periodic access review, access provisioning and modification, removal of user access and change management controls with respect to a payroll system implemented during the year; and (ii) untimely and inconsistent monitoring and oversight of third-party service organizations. Although we have identified no instances of any adverse effects due to these deficiencies, business processes that depend on the affected information systems or that depend on data from the affected information systems, could be adversely impacted.

Status of Remediation of Material Weaknesses in Internal Control over Financial Reporting

Management has developed a remediation plan to address the previously disclosed material weaknesses for which we implemented process and control improvements.

IT General Controls

Management continues to make progress in the remediation of all IT general control individual deficiencies that corresponded to the material weakness. The completed remediation actions include:

•

Improving the privileged access review process and performing a review of all in-scope systems for privileged user access;

•

Performing a review of the tools and improving the process relied upon to ensure users terminations or transfers are timely updated in systems;

•

Improving the access approval requirements to ensure all access requests are properly approved and documented prior to granting/modifying user access;

•

Adding a dedicated resource to support and perform key IT general controls, including privileged access review and review of third-party service organization control reports to assess their impact in relation to the control environment. Additionally, training on third-party service organization control reports review was delivered to relevant control owners; and

•

Improving the retention of evidence for testing and approval of system changes.

•

Training on strengthening Canopy Growth’s control environment was completed for all key stakeholders.

BioSteel business-to-business sales

Effective September 14, 2023, Canopy Growth no longer has a controlling interest in BioSteel Sports Nutrition Inc. ("BioSteel Canada"), and effective November 16, 2023, Canopy Growth no longer has a controlling interest in BioSteel Manufacturing, LLC ("BioSteel Manufacturing") and BioSteel Sports Nutrition USA LLC. Further, during November 2023, Canopy Growth completed the sale of substantially all of the assets of BioSteel Canada and BioSteel Manufacturing. As a result, the BioSteel segment is no longer considered part of management’s internal control over financial reporting and the material weakness previously identified in our internal controls is no longer applicable to Canopy Growth.

To remediate the existing material weakness on IT general controls, additional time is required to demonstrate the effectiveness of the remediation efforts. The material weakness cannot be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We may also conclude that additional measures may be required to remediate the material weakness in our internal control over financial reporting, which may necessitate further action. Remediation actions are subject to ongoing senior management review as well as oversight by the Audit Committee of the Board.

Changes in Internal Control over Financial Reporting.

We are taking actions to remediate the material weakness relating to our internal control over financial reporting as described above. Except as discussed above, there were no changes in our “internal control over financial reporting” (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the period covered by this Quarterly Report that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.