TUCOWS INC PA

Evaluation of Disclosure Controls and Procedures

As required by Rule 13a-15(b) of the Exchange Act, management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated, as of the end of the period covered by this report, the effectiveness of our disclosure controls and procedures as defined in Exchange Act Rule 13a-15(e). Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives, and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their control objectives. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that due to the material weakness in our internal control over financial reporting that is described below in Management's Annual Report on Internal Control over Financial Reporting, our disclosure controls and procedures were not effective as of December 31, 2023.

Management’s Annual Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act). Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with accounting principles generally accepted in the United States of America and includes those policies and procedures that:

Because of its inherent limitations, such as resource constraints, human error, lack of knowledge or awareness and the possibility of intentional circumvention of these controls, internal control over financial reporting may not prevent or detect misstatements. Furthermore, the design of any control system is based, in part, upon assumptions about the likelihood of future events, for which assumptions may ultimately prove to be incorrect. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Management, including our Chief Executive Officer and Chief Financial Officer, assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, our management used the criteria established inInternal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Based on the results of our evaluation, management has determined that due to the material weakness described below, our internal control over financial reporting was not effective as of December 31, 2023.

Material Weakness in Internal Control Over Financial Reporting

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. GAAP. In connection with our audit of consolidated financial statements for the year ended December 31, 2023, we identified certain control deficiencies in the design and operation of our internal control over financial reporting that constituted a material weakness in two components of internal control as defined by COSO 2013 (Control Activities, and Information and Communication).

As a result of the identified material weaknesses, management, including the CEO and CFO, concluded that internal control over financial reporting was not effective as of December 31, 2023. Deloitte LLP, the independent registered public accounting firm that audited our financial statements included in this annual report, has issued an attestation report on the effectiveness of our internal control over financial reporting as of December 31, 2023. Their attestation report is included in this annual report.

We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain (i) program change management controls for certain financial systems to ensure that IT program and data changes affecting certain IT systems and underlying accounting records are identified, tested, authorized and implemented appropriately and (ii) user access controls that adequately restrict user access to certain financial systems, programs and data to appropriate company personnel.

These IT deficiencies did not result in a material misstatement to the Annual Financial Statements for the period ended December 31, 2023, however, the deficiencies, when aggregated, could impact the effectiveness of IT-dependent controls (such as automated controls that address the risk of material misstatement to one or more assertions, and underlying data that support the effectiveness of system-generated reports used in related process-level manual controls that rely on information generated from the affected information technology systems) that could result in misstatements potentially impacting all financial statement accounts and disclosures that would not be prevented or detected. Accordingly, management has determined these deficiencies in the aggregate constitute a material weakness.

Deloitte LLP, our independent registered public accounting firm, has audited our consolidated financial statements and expressed an unqualified opinion thereon. Deloitte has issued an attestation report on the effectiveness of our internal control over financial reporting as of December 31, 2023. These reports set forth at the beginning of Part II, Item 8 if this Annual Report on Form 10-K.

** Remediation Plan for Material Weakness in Internal Control Over Financial Reporting**

To remediate the material weakness described above, the Company's remediation efforts included evaluating access controls to key financial systems and implementing enhanced procedures for regular access reviews. Under the oversight of the Audit Committee, management will continue to remediate and maintain effective IT controls over impacted financial systems. These steps will include training for IT control owners, enhanced change management procedures, and improved documentation that will clearly identify management’s expectations of the control activities. The material weakness will not be considered remediated until the applicable remedial controls operate for a sufficient period. The Company has made progress in the remediation efforts but cannot estimate when these efforts will be completed.

The material weaknesses that were previously disclosed as of December 31, 2022 were remediated as of December 31, 2023. See “Item 9A. Controls and Procedures — Management’s Annual Report on Internal Control over Financial Reporting” and “Item 9A. Controls and Procedures — Remediation Plan for Material Weaknesses in Internal Control over Financial Reporting” contained in the Company’s report on Form 10-K for the fiscal year ended December 31, 2022 and “Item 4. Controls and Procedures” contained in the Company’s subsequent quarterly reports on Form 10-Q during 2023, for disclosure of information about the material weaknesses that were reported as a result of the Company’s annual assessment as of December 31, 2022 and the remediation plan for that material weaknesses. As disclosed in the quarterly reports on Form 10-Q for the first three quarters of 2023, the Company has monitored the controls necessary to remediate the material weaknesses, and as of December 31, 2023, such controls were successfully tested and the material weaknesses were remediated.

Changes in Internal Control over Financial Reporting

Other than the material weaknesses noted above, there were no changes made in our internal controls over financial reporting occurred during Fiscal 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.