Better Choice Co Inc

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our chief executive officer (our principal executive officer) and our chief financial officer (our principal financial officer) evaluated the effectiveness of our disclosure controls and procedures as of the year ended December 31, 2023. Based upon that evaluation, our principal executive officer and principal financial officer concluded that, as of December 31, 2023, our disclosure controls and procedures were not effective due to the material weaknesses discussed below. Notwithstanding the material weaknesses in our internal control over financial reporting, we have concluded that the condensed consolidated financial statements included in this Form 10-K fairly present, in all material respects, our financial position, results of operations and cash flows for the periods presented in conformity with accounting principles generally accepted in the United States of America.

Management’s Annual Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projection of any evaluation of effectiveness to future periods is subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with policies or procedures may deteriorate. In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control – Integrated Framework (2013 Framework). Based on this assessment, management concluded that, as of December 31, 2023, the Company’s internal control over financial reporting was not effective due to the material weaknesses described below.

Material Weaknesses

In July 2023, Management became aware of a cybersecurity incident via email compromise. Management investigated the matter internally and engaged a third-party forensics expert to facilitate a full investigation to determine the exact nature, timing, and magnitude of the breach. The root cause of the incident was traced to lack of Multi-Factor Authentication (“MFA”) protection allowing a brute force attack on the user’s hosted Microsoft Exchange email account. Management determined that although there was a control that was designed and implemented, it did not prevent the cybersecurity breach. Management has thus determined that there is a material weakness related to the failure to maintain controls that should have been operating effectively as of December 31, 2023.

Additionally, our internal controls over financial reporting were not effective as of December 31, 2023, due to a material weakness in analyzing complex accounting transactions, including the proper classification of warrants as liabilities and the related financial statement disclosures, and the proper assessment of triggering events that occurred that would require an impairment analysis over intangible assets. In light of this material weakness, we performed additional analysis as deemed necessary to ensure that our consolidated financial statements were prepared in accordance with GAAP. Accordingly, management believes that the financial statements included in this report present fairly in all material respects our financial position, results of operations and cash flows for the periods presented.

Management has determined that we did not design and maintain effective controls to support proper revenue recognition. Specifically, management did not have effective controls (i) to ensure the accuracy of data input for price and quantity and (ii) to ensure that there was effective testing of period end sales cutoff, including a proper review and comparison of invoices.

Remediation Plan

To address the material weakness associated with failure to maintain controls over the operating effectiveness of IT general controls, we transitioned to a new outsourced managed IT service provider with an appropriate level of knowledge and technical experience to design and maintain IT general controls. We have also planned to (i) establish policies and procedures for the design and operation of IT general controls, (ii) implement an IT general controls framework, and (iii) where necessary, we have identified, implemented, and documented IT general controls. We continue to evaluate the appropriate controls to design and maintain effective controls supporting financial systems relevant to our financial reporting processes. We continue to evaluate staffing requirements and technology improvement opportunities to further address and achieve remediation.

To address the material weakness in internal controls related to the accounting for complex accounting transactions, we plan to engage outside advisors with specialist knowledge of GAAP and valuation as it relates to our complex financial instruments.

To address the material weakness in internal controls related to the revenue recognition, we continue to evaluate the appropriate controls to design and maintain effective controls supporting revenue recognition and are in the process of enhancing certain controls over revenue, including adding resources and training programs addressing the design, implementation, and documentary evidence requirement of control procedures over revenue recognition for appropriate personnel.

Although we implemented measures and plan to implement additional measures to remedy our internal control deficiencies, there can be no assurance that our efforts will be successful. In addition, until the remediation steps have been completed and operated for a sufficient period of time, and subsequent evaluation of their effectiveness is completed, the material weaknesses identified and described above will continue to exist.

Changes in Internal Control Over Financial Reporting

Other than the material weaknesses described above, there has not been any change in our internal controls over financial reporting identified in connection with the evaluation that occurred during the quarter ended December 31, 2023 that has materially affected, or is reasonably likely to materially affect, those controls.

Attestation Report of Independent Registered Public Accounting Firm

This Annual Report on Form 10-K does not include an attestation report of the Company’s registered public accounting firm, as non-accelerated filers are exempt from the auditor attestation requirements of Section 404(b) of the Sarbanes-Oxley Act.