TUCOWS INC PA

(a) Evaluation of Disclosure Controls and Procedures

Our management, including our Chief Executive Officer and Chief Financial Officer, performed an evaluation of our disclosure controls and procedures as required by Rule 13a-15(b) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Based on the evaluation as of September 30, 2024 management has concluded that our disclosure controls and procedures were not effective as a result of a material weakness in our internal control over financial reporting as described in our Annual Report on Form 10-K for the year ended December 31, 2023.

We have made progress remediating the material weakness identified in our Annual Report on Form 10-K for the year ended December 31, 2023 which is described in the next section. Notwithstanding the material weakness described in Item 9A of the Annual Report on Form 10-K for the year ended December 31, 2023, we believe our consolidated statements presented in this Form 10-Q fairly represent, in all material respects, our financial position, results of operations and cash flows for all periods presented herein.

(b) Changes in Internal Control over Financial Reporting

Except set forth below, during the nine months ended September 30, 2024, there have not been any changes in our internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

(c) Plan for Remediation of Material Weakness in Internal Control over Financial Reporting

As previously discussed in our Annual Report on Form 10-K for the year ended December 31, 2023, we are in the process of remediating the material weakness in our internal control over financial reporting. In connection with our assessment of the effectiveness of internal control over financial reporting, we determined that we did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain (i) program change management controls for certain financial systems to ensure that IT program and data changes affecting certain IT systems and underlying accounting records are identified, tested, authorized and implemented appropriately and (ii) user access controls that adequately restrict user access to certain financial systems, programs and data to appropriate company personnel. Our remediation plan includes evaluating access controls to key financial systems and implementing enhanced procedures for regular access reviews. Under the oversight of the Audit Committee, management will continue to remediate and maintain effective IT controls over impacted financial systems. These steps will include training for IT control owners, enhanced change management procedures, and improved documentation that will clearly identify management’s expectations of the control activities. Subsequent to our December 31, 2023 fiscal year end, we began taking a number of actions, including evaluating access controls to key financial systems and implementing enhanced procedures for regular access reviews. We expect to continue our remediation efforts, including testing of operating effectiveness of new controls, and expect to incur additional costs remediating this material weakness.