Turning Point Brands Inc

Disclosure Controls and Procedures

As of December 31, 2023, the Company’s management, with participation of the Company’s President and Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), evaluated the effectiveness of the Company’s disclosure controls and procedures as defined in Exchange Act Rules 13a-15(e) and 15d-15(e). Based on that evaluation, the CEO and CFO concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2023, solely due to the material weaknesses in internal control over financial reporting described below.

Internal Control

Pursuant to Section 404 of the Sarbanes-Oxley Act of 2002, we have included a report that provides management’s assessment of our internal control over financial reporting as part of this Annual Report on Form 10-K for the year ended December 31, 2023. Management’s report is included below under the caption entitled “Management’s Report on Internal Control Over Financial Reporting,” and is incorporated herein by reference.

Management’s Report on Internal Control over Financial Reporting

The consolidated financial statements appearing in this Annual Report have been prepared by the management that is responsible for their preparation, integrity, and fair presentation. The statements have been prepared in accordance with U.S. generally accepted accounting principles, which requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Securities Exchange Act of 1934, as amended). Our internal control system was designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Further, because of changes in conditions, the effectiveness of an internal control system may vary over time.

Under the supervision and with the participation of our management, including our CEO, we conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2023, based on the framework in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (“COSO ICIF”).

A material weakness is defined as a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Based on our evaluation under the framework in COSO ICIF, our management concluded that our internal control over financial reporting was not effective as of December 31, 2023, solely due to the following material weakness:

We did not design and maintain effective internal controls related to our information technology general controls (“ITGCs”) in the areas of user access and program change-management over certain information technology (“IT”) systems that support the Company’s financial reporting processes. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were a result of: IT control processes lacking sufficient documentation such that the successful operation of ITGCs was overly dependent upon knowledge and actions of certain individuals with IT expertise and inherent system limitations. The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results.

Our independent registered public accounting firm has audited the consolidated financial statements appearing in this Annual Report and the effectiveness of our internal controls over financial reporting and has issued their reports, included herein.

Notwithstanding the above identified material weakness, management believes the financial statements as included in Part II of this Annual Report on Form 10-K fairly represent in all material respects the Company’s financial condition, results of operations and cash flows as of and for the periods presented in accordance with generally accepted accounting principles in the U.S.

Remediation Plan

While our remediation plan may evolve and expand, management has been implementing and continues to implement measures designed to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) implementation of a new ERP system in 2024; (ii) developing and maintaining documentation underlying ITGCs; (iii) implementing an IT management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (iv) enhanced quarterly reporting on the remediation measures to the Audit Committee of the Board of Directors.

We believe that these actions will remediate the material weakness. The material weakness will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Controls over Financial Reporting

Other than in connection with aspects of our remediation plan, there were no changes in the Company’s internal controls over financial reporting during the fiscal quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

Management has redesigned its control environment around risk assessment to remediate the material weakness identified in 2022. The improvements included: the hiring of two positions dedicated to SOX Compliance and SEC Reporting; a risk and control design review with third party consultants; implementation of new and improved controls around fraud risk assessments, ERM reporting, and the internal control process; and additional training provided around risk and controls. These remediation actions have strengthened the design and operating effectiveness of controls relating to the risk assessment process.