APi Group Corp

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to provide reasonable assurance that information required to be disclosed by us in the reports we file or submit under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating such controls and procedures, we recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives.

As required by Rule 13a-15(b) of the Exchange Act, our management, including our Chief Executive Officer and Chief Financial Officer, have evaluated the effectiveness of our disclosure controls and procedures(as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this annual report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures are not effective as of December 31, 2023 due to the material weaknesses in internal control over financial reporting described below.

Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their objectives as specified above. However, our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within our Company have been detected.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a‑15(f) and 15d-15(f) under the Exchange Act. Under the supervision of our Chief Executive Officer and Chief Financial Officer, management conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2023 based on the guidelines established in Internal Control — Integrated Framework (2013 Framework) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, our management concluded that our internal control over financial reporting was not effective as of December 31, 2023 due to the material weaknesses in internal control over financial reporting identified and further described below.

A material weakness (as defined in Rule 12b-2 under the Exchange Act) is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. Management's assessment identified the following material weakness in the Company's internal control over financial reporting:

•The Company did not have adequate user access controls specific to segregation of duties in the Company’s change management process in certain information technology systemsof the Chubb fire and security business that was acquired in 2022, which resulted from ineffective risk assessment. As a result, process level automated and manual controls that are dependent on the completeness and accuracy of information derived from the affected systems across all financial reporting processes were also considered ineffective because they could have been adversely impacted.

•The Company did not have adequate controls to ensure the completeness and accuracy of time keeping and service order information used in the financial reporting processes of certain businesses that is processed and hosted by a third-party service organization. The Company did not have an effective risk assessment process to identify and assess the risks of misstatement associated with the third-party service organization processing and hosting of related data on behalf of the Company. As a result, process level automated and manual controls that are dependent on the completeness and accuracy of information related to revenue and cost of revenues and derived from the affected systems were also considered ineffective because they could have been adversely impacted.

The control deficiencies did not result in material misstatements identified in the preparation of consolidated financial statements as of and for the year ended December 31, 2023. However, these control deficiencies created a reasonable possibility that a material misstatement to the consolidated financial statements would not have been prevented or detected on a timely basis.

KPMG LLP, the Company’s independent registered public accounting firm, has audited our consolidated financial statements included in this report, and has also issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting, which is included elsewhere in this Form 10-K.

2023 Remediation Activities

In its 2022 Item 9A filed on Form 10-K, management identified material weaknesses over user access controls related to an information technology system resulting from insufficient risk assessment and ineffective operation of process level controls over revenue recognition resulting from insufficient training. Management, through the below remediation activities, were able to successfully remediate the previously communicated material weaknesses in existence as of December 31, 2022.

The Company performed the following remediation activities in 2023 in relation to the legacy businesses:

a. We conducted additional training with control owners and reviewers within operations and finance with a specific focus on sufficient documentation and evidence in the execution of the controls;

b. We conducted an evaluation of ITGCs and related policies, with a focus onrisk assessment procedures and controls related to access to IT systems and implemented an IT management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes.

As a result of the remediation activities during 2023, we remediated the prior year material weaknesses within our legacy business.

Remediation Plan of Newly Identified Material Weakness

While management was successful in completing its multi-year remediation of prior year material weaknesses within the legacy business, the establishment of internal controls over financial reporting at certain subsidiaries of the recently acquired Chubb Fire & Security business and the inability of a third-party service organization to provide a service auditors’ report led to the identification of new material weaknesses. We will continue to strengthen our internal control over financial reporting and are committed to ensuring that such controls are operating effectively. We are implementing process and control improvements to address the above material weaknesses identified in 2023 as follows:

•We will implement third-party software designed to identify segregation of duties conflicts based on established roles and responsibilities;

•We will conduct an analysis of conflict reports derived by the third party software and document mitigation where established controls exist and operate effectively or create newly designed controls to mitigate those conflicts where such controls do not exist;

•We generally require our third-party service organizations to provide a SOC 1, Type 2 report to us. However, if a SOC1, Type 2 report is not available, we will evaluate the third-party’s relevant systems and compare other available options. If no other options exist, Management will design and implement process level controls to ensure information used in our financial reporting process is complete and accurate.

The material weaknesses in our internal control over financial reporting will not be considered remediated until the remediated controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls will be met, and no evaluation of controls can provide absolute assurance that all control deficiencies or material weaknesses have been or will be detected. There is no assurance that the remediation will be fully effective. As described above, the material weakness has not been remediated as of the filing date of this Annual Report. If these remediation efforts do not prove effective and control deficiencies and material weaknesses persist or occur in the future, the accuracy and timing of our financial reporting may be adversely affected.

Changes in Internal Control over Financial Reporting

Management, together with our CEO and CFO, evaluated the changes in the Company’s internal control over financial reporting during the quarter ended December 31, 2023.

Other than changes described above, there have been no changes in the Company’s internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Securities Exchange Act of 1934, as amended) during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.