Greenlane Holdings Inc

Evaluation of Disclosure Controls and Procedures

Under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation (pursuant to Rule 13a-15(b) of the Exchange Act) of the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) under the Exchange Act as of December 31, 2023.

Disclosure controls and procedures are controls and other procedures that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include controls and procedures designed to ensure that information required to be disclosed in our company’s reports filed under the Exchange Act is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial and Legal Officer, to allow timely decisions regarding required disclosure.

Based on the evaluation of our disclosure controls and procedures, our Chief Executive Officer and Chief Financial and Legal Officer concluded that our disclosure controls and procedures were ineffective as of December 31, 2023 due to the material weaknesses identified and described below.

Management’s Report on Internal Control Over Financial Reporting

Our management, including our Chief Executive Officer and Chief Financial and Legal Officer, is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP. Our internal control over financial reporting includes those policies and procedures that: (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on the financial statements.

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial and Legal Officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2023, based on the framework in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2013 framework). Based on this evaluation, our Chief Executive Officer and Chief Financial and Legal Officer have concluded that as of December 31, 2023, the Company has not maintained effective internal control over financial reporting due to the material weaknesses identified and described below.

Because we are an “emerging growth company” under the JOBS Act, our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting for so long as we are an emerging growth company.

Material Weaknesses

As previously described in Item 9A of our Annual Report on Form 10-K for the year ended December 31, 2021, we began implementing a remediation plan to address the material weaknesses identified in the prior year, and our management continues to be actively engaged in the remediation efforts.

Among the previously reported design and operating deficiencies which contributed to material weaknesses in our control activities, management noted ineffective user access controls over certain IT systems to appropriately segregate duties and adequately restrict user access to financial applications and data to the appropriate personnel. While certain compensating control activities have been designed and implemented to mitigate the risks related to ineffective user access controls, these compensating control activities are not expected to operate at a level of precision that would prevent or detect a misstatement that could be material.

Control Environment

We did not maintain an effective control environment to enable the identification and mitigation of risks of material accounting errors and ensure corrective activities were appropriately applied, prioritized, and implemented in a timely manner.

Risk Assessment

As part of our remediation efforts related to the material weaknesses identified in the prior year, we continued our efforts during 2023 to design an effective risk assessment, which was not completed or fully implemented in order to identify and mitigate key business and financial reporting risks to the organization. Control deficiencies were identified which constitute material weaknesses relating to: (i) identifying, assessing, and communicating appropriate objectives, (ii) identifying and analyzing risks to achieve these objectives, (iii) considering the potential for fraud in assessing risks to the achievement of objectives, and (iv) identifying and assessing changes that could significantly impact the system of internal controls.

Control Activities

As part of our remediation efforts related to the material weaknesses identified in the prior year, we continued our efforts during 2023 to design and implement control activities, however, design efforts relating to control activities were not fully implemented. Control deficiencies were identified associated with control activities. Specifically, these control deficiencies constitute material weaknesses, either individually or in the aggregate, relating to: (i) selecting and developing control activities that contribute to the mitigation of risks and support achievement of objectives, (ii) selecting and developing general control activities over technology to support the achievement of objectives, and (iii) deploying control activities through policies that establish what is expected and procedures that put policies into action.

The following design and operating deficiencies, individually and in the aggregate, contributed to material weaknesses in our control activities, including:

Information and Communication

We did not implement effective information and communication control activities. A control deficiency was identified which constitutes a material weakness relating to information technology controls, which includes information security, systems change management and computer operations for systems and applications that are critical to processing financial transactions and capturing and reporting information in the financial reporting process. These ineffective information technology controls contributed to ineffective data validation of spreadsheets and system-generated reports utilized in the preparation of the financial statements and disclosures.

Monitoring

We did not implement effective monitoring activities. Control deficiencies were identified which constitute material weaknesses, individually and in the aggregate, relating to: (i) selecting, developing, and performing ongoing evaluation to ascertain whether the components of internal controls are present and functioning, and (ii) evaluating and communicating internal control deficiencies in a timely manner to those parties responsible for taking corrective action.

Remediation Plan and Status

Changes in Internal Control Over Financial Reporting

As discussed above, in 2021 we began a multi-year implementation of a new ERP system which fully replaced our legacy financial systems in 2024. The ERP system is designed to accurately maintain the Company’s financial records, enhance the flow of financial information, improve data management and provide timely information to our management team.

There were no other changes to our internal control over financial reporting that occurred during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

Management recognizes that a control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud or error, if any, have been detected. These inherent limitations include the realities that judgments in decision making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.