CareDx Inc

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

To the shareholders and the Board of Directors of CareDx, Inc.

Opinion on the Financial Statements

We have audited the accompanying consolidated balance sheets of CareDx, Inc. and subsidiaries (the "Company") as of December 31, 2023 and 2022, the related consolidated statements of operations, comprehensive loss, convertible preferred stock and stockholders’ equity, and cash flows, for each of the three years in the period ended December 31, 2023, and the related notes (collectively referred to as the "financial statements"). In our opinion, the financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2023 and 2022, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2023, in conformity with accounting principles generally accepted in the United States of America.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company's internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated February 28, 2024, expressed an adverse opinion on the Company's internal control over financial reporting because of material weaknesses.

Basis for Opinion

These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on the Company's financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

Critical Audit Matters

The critical audit matters communicated below are matters arising from the current-period audit of the financial statements that were communicated or required to be communicated to the audit committee and that (1) relate to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the financial statements, taken as a whole, and we are not, by communicating the critical audit matters below, providing separate opinions on the critical audit matters or on the accounts or disclosures to which they relate.

Testing Services Revenue (non-Medicare) — Refer to Note 2 to the consolidated financial statements

The Company’s testing services revenue is recognized when results of the test are provided to the healthcare provider, at which time the Company generally bills for its services. The Company estimates revenue for non-Medicare payers using transaction prices determined for each financial class of payers using history of reimbursements.

The transaction price estimate includes analysis of an average reimbursement per test and a percentage of tests reimbursed. This estimate requires significant judgement. The Company monitors revenue estimates at each reporting period based on actual cash collections in order to assess whether a revision to the estimate is required. Changes in transaction price estimates are updated quarterly based on actual cash collected. The Company also considers whether historical collections per test are indicative of future collections or if there are any current or expected developments or changes that could affect reimbursement rates.

We identified management’s estimation of the transaction price for transaction services billed to non-Medicare payers as a critical audit matter due to the significant judgments required by management to estimate how coverage practices and policies of payers might affect amounts received. This required a high degree of auditor judgment and an increased extent of effort, including the involvement of more experienced engagement team members, when performing audit procedures to evaluate the estimated transaction prices.

Our audit procedures related to management’s estimation of transaction prices for testing services revenue, included the following, among others:

•We tested the assumptions used by management to estimate transaction prices by:

•Testing the mathematical accuracy of management’s calculation.

•Testing the historical cash receipts from non-Medicare payers used in the estimate of transaction prices, by making selections and agreeing the selected information to source documents.

•Testing management’s ability to estimate transaction prices accurately by comparing recorded revenue to cash receipts received through December 2023.

•Evaluating trends in revenue and accounts receivable compared to previous periods to identify evidence inconsistent with management’s estimated transaction prices.

•We tested the accuracy and completeness of the lab billing report by tracing to source documents, including the test requisition form, fax support, proof of insurance, and payment support.

Testing Services Revenue (Medicare)— Refer to Note 2 to the consolidated financial statements

Revenue recognized for tests billed to Medicare is based on the agreed current reimbursement rate per test adjusted for historical collection trends where applicable. During 2023, new billing articles (the Billing Articles) issued by Palmetto MolDX, or MolDX, impacted Medicare coverage for certain of the Company’s tests, including AlloSure Kidney, AlloSure Heart and AlloMap Heart, and required the Company to implement new processes to address the requirements related to the Medicare claim submissions for reimbursement.

We identified management’s determination of whether the reimbursement claim submission for an AlloSure Kidney, AlloSure Heart, or AlloMap Heart test for which Medicare is the payer complied with the requirements of the Billing Articles, as a critical audit matter because of the challenging judgments required to determine if a reimbursement claim submission complied with the requirements of the Billing Articles. This required a high degree of auditor judgment and increased extent of effort when performing audit procedures to determine if the reimbursement claim submission for the test met the new requirements of the Billing Articles.

•We read the Billing Articles regarding the requirements for Medicare reimbursement for each type of testing service.

•We made inquiries of members of the Company’s accounting department, billing department, and legal department regarding the impact of the Billing Articles and the effects on revenue recognition.

•We tested the Company’s revised billing practices in response to the Billing Articles and evaluation of whether collection of consideration was probable when Medicare was identified as the payer, by making selections and agreeing required test information to source documents and tracing to cash receipts received from Medicare through December 31, 2023.

Impact on Audit of Financial Statements Because of Material Weaknesses in Internal Control Over Reporting - Refer to Management’s Annual Report on Internal Control Over Financial Reporting

As discussed in Management’s Annual Report on Internal Control Over Financial Reporting, the Company identified material weaknesses across multiple components of the Internal Control – Integrated Framework (2013) issued by COSO.

Because these material weaknesses impact the Company’s controls over information technology (IT) systems and business processes, affect substantially all financial statement account balances and disclosures, and required us to increase the extent of our audit effort, including the need to modify the nature and extent of audit evidence obtained, we have identified the impact to our audit procedures as a result of the material weaknesses as a critical audit matter.

As a result of the material weaknesses, in performing our audit procedures we lowered the threshold for investigating differences between recorded amounts and independent expectations developed by us that we would have otherwise used, and increased the number of selections we would have otherwise made if the Company’s controls were designed and operating effectively. In addition, we performed additional procedures to test the completeness and accuracy of the information included in all system reports or information generated by the Company’s IT systems which were utilized for audit evidence.

/s/Deloitte & Touche LLP

San Jose, California

February 28, 2024

We have served as the Company's auditor since 2018.

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

To the shareholders and the Board of Directors of CareDx, Inc.

Opinion on Internal Control over Financial Reporting

We have audited the internal control over financial reporting of CareDx, Inc. and subsidiaries (the “Company”) as of December 31, 2023, based on criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, because of the effect of the material weaknesses identified below on the achievement of the objectives of the control criteria, the Company has not maintained effective internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control — Integrated Framework (2013) issued by COSO.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2023, of the Company and our report dated February 28, 2024, expressed an unqualified opinion on those financial statements.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Annual Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Material Weaknesses

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis. The following material weaknesses have been identified and included in management's assessment:

General Information Technology Controls (GITCs)

The Company did not design and maintain effective general information technology controls (“GITCs”) for information systems and applications that are relevant to the preparation of the consolidated financial statements. Specifically, the Company did not design and maintain: (i) sufficient user access controls to ensure appropriate segregation of duties, logical access controls to prevent unauthorized user access and adequately restrict user and privileged access to financial applications, programs and data to appropriate Company personnel; (ii) program change management controls to ensure that information technology (“IT”) program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately with appropriate segregation of duties; and (iii) computer and network operations controls to ensure that batch and interface jobs are monitored and privileges are appropriately granted, authorized and monitored. As a result, business process controls (automated and manual) that are dependent on the ineffective GITCs, or that rely on data produced from systems impacted by the ineffective GITCs, are also deemed ineffective, which affects substantially all financial statement accounts and disclosures.

Purchase Order Approval Workflow

The Company did not design and maintain effective process-level control activities related to procurement to ensure appropriate approval of purchase orders, which could affect the amount and classification of costs capitalized or expensed.

COSO Framework

The Company did not fully maintain components of the COSO framework, including elements of the control environment, information and communication, control activities and monitoring activities components, relating to: (i) sufficiency of competent personnel to perform internal control activities and support the achievement of the Company’s internal control objectives; (ii) enforcing accountability of personnel for the performance of their internal control responsibilities across the organization in the pursuit of objectives; (iii) designing and maintaining general control activities over technology to support the achievement of the Company’s internal control objectives; (iv) performing control activities in accordance with established policies in a timely manner; and (v) performing sufficient reviews of information to assess its relevance, accuracy, and completeness in supporting the internal control components. As such, the Company’s management concluded that the Company did not have an adequate process in place to complete its assessment of the design and operating effectiveness of internal control over financial reporting in a timely manner.

These material weaknesses were considered in determining the nature, timing, and extent of audit tests applied in our audit of the consolidated financial statements as of and for the year ended December 31, 2023, of the Company, and this report does not affect our report on such financial statements.

/s/Deloitte & Touche LLP

San Jose, California

February 28, 2024