Canopy Growth Corp

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, and summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures. Any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. An evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this Annual Report on Form 10‑K was made under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer.

Based upon this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of March 31, 2024, our disclosure controls and procedures (a) are effective to ensure that information required to be disclosed by us in reports filed or submitted under the Exchange Act is timely recorded, processed, summarized and reported and (b) include, without limitation, controls and procedures designed to ensure that information required to be disclosed by us in reports filed or submitted under the Exchange Act is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act). Our internal control over financial reporting is a process designed under the supervision of our Chief Executive Officer and Chief Financial Officer to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. GAAP.

Our internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets; provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP, and that receipts and expenditures are being made only in accordance with authorizations of our management and directors; and provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. In addition, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Management conducted an assessment of the effectiveness of our internal control over financial reporting as of March 31, 2024, based on the framework established in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission in 2013. Based on this evaluation, management has determined that our internal control over financial reporting as of March 31, 2024 was effective.

Our independent registered public accounting firm, PKF O’Connor Davies, LLP, who audited our financial statements included in this Annual Report, has issued its report on the effectiveness of our internal control over financial reporting as of March 31, 2024, which is included herein.

Remediation of Previously Disclosed Material Weaknesses in Internal Control Over Financial Reporting

As previously disclosed in Item 9A of the Annual Report for the fiscal year ended March 31, 2023, management concluded that material weaknesses existed in our internal control over financial reporting relating to:

•

The accounting for sales recorded by the BioSteel segment, which resulted in material misstatements relating to revenue and trade receivables, particularly with respect to the timing and amount of revenue recognition. Specifically, we did not design and maintain effective controls to sufficiently assess the timing, amount, and appropriateness of revenue recognition. This included a lack of segregation of duties in the review of customer orders, inadequate controls over the review and approval of sales returns, and inadequate controls relating to revenue recognition policies and procedures. This also contributed to the failure to impair goodwill related to the BioSteel reporting unit on a timely basis as changes in the performance of BioSteel were not identified in a timely manner, and the failure to accurately record the redeemable noncontrolling interest; and

•

IT general control deficiencies that aggregated to a material weakness. These deficiencies specifically related to: (i) logical access management, including untimely periodic access review, access provisioning and modification, removal of user access and change management controls with respect to a payroll system implemented during the year; and (ii) untimely and inconsistent monitoring and oversight of third-party service organizations. Although we have identified no instances of any adverse effects due to these deficiencies, business processes that depend on the affected information systems or that depend on data from the affected information systems, could be adversely impacted.

During fiscal year 2024, management, with the oversight of the Audit Committee of our Board of Directors, completed the implementation of our previously disclosed remediation plan that included:

IT General Controls

•

Improving the privileged access review process and performing a timely review of all in-scope systems for privileged user access;

•

Performing a review of the tools and improving the process relied upon to ensure users terminations or transfers are timely updated in systems;

•

Improving the access approval requirements and ensuring all access requests were properly approved and documented prior to granting/modifying user access;

•

Adding a dedicated resource to support and perform key IT general controls, including privileged access review and review of third-party service organization control reports to assess their impact in relation to the control environment. Additionally, training on third-party service organization control reports review was delivered to relevant control owners;

•

Improving the documentation and retention of evidence for testing and approval of system changes;

•

Enhancing the assignment of control responsibilities and accountability to responsible operational and IT personnel; and

•

Completing training on strengthening Canopy Growth’s control environment for all key stakeholders aimed at improving employee knowledge and skills in internal controls over financial reporting, including IT General Controls.

BioSteel business-to-business sales

•

Effective September 14, 2023, Canopy Growth no longer has a controlling interest in BioSteel Sports Nutrition Inc. ("BioSteel Canada"), and effective November 16, 2023, Canopy Growth no longer has a controlling interest in BioSteel Manufacturing, LLC ("BioSteel Manufacturing") and BioSteel Sports Nutrition USA LLC. Further, during November 2023, Canopy Growth completed the sale of substantially all of the assets of BioSteel Canada and BioSteel Manufacturing. As a result, the BioSteel segment is no longer considered part of management’s internal control over financial reporting and the material weakness previously identified in our internal controls is no longer applicable to Canopy Growth.

During the fourth quarter of fiscal 2024, we completed testing of the operating effectiveness of the implemented controls and found them to be effective. As a result, we have concluded the material weaknesses have been remediated as of March 31, 2024.

Changes in Internal Control Over Financial Reporting

Other than the execution of the material weakness remediation activities discussed above, there were no changes in our internal control over financial reporting (as such term is defined in Rules 13a–15(f) and 15d–15(f) under the Exchange Act) that occurred during our most recent quarter, that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.