CareDx Inc

Evaluation of Disclosure Controls and Procedures

Management, including our principal executive officer and principal financial officer, evaluated the effectiveness of our disclosure controls and procedures, as such terms are defined in Rules 13a-15(e) and 15d-15(e) promulgated under the Exchange Act, as of September 30, 2024. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs. Based on such evaluation, our principal executive officer and principal financial officer concluded that, as of September 30, 2024, in light of the material weaknesses identified in our internal control over financial reporting, our disclosure controls and procedures were not effective at the reasonable assurance level and are not effective to provide reasonable assurance that information required to be disclosed in the reports we file and submit under the Exchange Act, is (i) recorded, processed, summarized and reported as and when required and (ii) accumulated and communicated to our management, including the principal executive officer and principal financial officer, as appropriate to allow timely discussion regarding required disclosure.

Previously Reported Material Weaknesses

As disclosed in Item 9A, “Controls and Procedures” within our Annual Report on Form 10-K for the fiscal year ended December 31, 2023, which was filed with the SEC on February 28, 2024, the following material weaknesses were identified as of December 31, 2023:

General Information Technology Controls. We did not design and maintain effective general information technology controls, or GITCs, for information systems and applications that are relevant to the preparation of the consolidated financial statements. Specifically, we did not design and maintain: (i) sufficient user access controls to ensure appropriate segregation of duties, logical access controls to prevent unauthorized user access and adequately restrict user and privileged access to financial applications, programs and data to appropriate Company personnel; (ii) program change management controls to ensure that information technology, or IT, program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately with appropriate segregation of duties; and (iii) computer and network operations controls to ensure that batch and interface jobs are monitored and privileges are appropriately granted, authorized and monitored. As a result, business process controls (automated and manual) that are dependent on the ineffective GITCs, or that rely on data produced from systems impacted by the ineffective GITCs, are also deemed ineffective, which affects substantially all financial statement account balances and disclosures.

Purchase Order Approval Workflow. We did not design and maintain effective process-level control activities related to procurement to ensure appropriate approval of purchase orders, which could affect the amount and classification of costs capitalized or expensed.

COSO Framework. We did not fully maintain components of the COSO framework, including elements of the control environment, information and communication, and control activities and monitoring activities components, relating to: (i) sufficiency of competent personnel to perform internal control activities and support the achievement of our internal control objectives; (ii) enforcing accountability of personnel for the performance of their internal control responsibilities across the organization in the pursuit of objectives; (iii) designing and maintaining general control activities over technology to support the achievement of our internal control objectives; (iv) performing control activities in accordance with established policies in a timely manner; and (v) performing sufficient reviews of information to assess its relevance, accuracy, and completeness in supporting the internal control components. As such, our management concluded that we did not have an adequate process in place to complete its assessment of the design and operating effectiveness of internal control over financial reporting in a timely manner.

After giving full consideration to these material weaknesses, and the additional analyses and other procedures we performed to ensure that our unaudited condensed consolidated financial statements included in this Quarterly Report on Form 10-Q were prepared in accordance with U.S. GAAP, our management has concluded that our condensed consolidated financial statements present fairly, in all material respects, our financial position, results of operations and cash flows for the periods disclosed in conformity with U.S. GAAP.

Management’s Plan to Remediate the Material Weaknesses

Our management is committed to maintaining a strong internal control environment. In response to the material weaknesses described above, our management is continuing to take actions to remediate the material weaknesses in internal control over financial reporting, which include but are not limited to the following:

•Continuing to enhance the design and control procedures of the GITCs to ensure that the control activities related to GITCs are functioning appropriately.

•Continuing to implement training to ensure a clear understanding of risk assessment, control execution, and monitoring activities related to financial reporting and continue driving accountability of Sarbanes-Oxley Act of 2002 control activities.

•Continuing to focus on controls execution and monitoring activities of internal controls related to the procure-to-pay process.

•Continuing to expand the available resources at the Company with experience designing and implementing control activities, including GITCs, through hiring and use of third-party consultants and specialists.

Management is taking steps to enhance our internal control over financial reporting and remediate the material weaknesses identified during the year ended December 31, 2023. During the third quarter of 2024, we continued the testing of our existing and redesigned processes to assess our remediation progress. These controls will not be deemed effective until they are performed for a sufficient period and we test and conclude that the controls are operating effectively during the year. We believe the measures described above will remediate the material weaknesses identified during the year ending December 31, 2024. We cannot, however, provide any assurance that our remediation efforts will be successful or that our internal control over financial reporting will be effective because of these efforts. We are committed to continuing to improve our internal control processes and will continue to review, optimize, and enhance our control environment. As we continue to evaluate and work to improve our internal control over financial reporting, we may take additional measures to address control deficiencies, or we may modify certain of the remediation measures described above. The Company will monitor the effectiveness of its remediation plan and refine its remediation plan as appropriate.

Changes in Internal Control over Financial Reporting

Other than the changes associated with the material weaknesses and remediation actions noted above, there have been no changes in our internal control over financial reporting during the quarter ended September 30, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.