Trulieve Cannabis Corp

Conclusion Regarding the Effectiveness of Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to ensure that information required to be disclosed in our reports under the Securities Exchange Act of 1934, as amended (the Exchange Act), is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer (CEO) and Chief Financial Officer (CFO), as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating the disclosure controls and procedures, management recognized that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, as ours are designed to do, and management necessarily was required to apply its judgment in evaluating the risk related to controls and procedures.

In connection with the preparation of this Form 10-K, as of December 31, 2023, an evaluation was performed under the supervision and with the participation of our management, including the CEO and CFO, of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act). Based on that evaluation, our management concluded that as of December 31, 2023, we did not maintain effective disclosure controls and procedures because of the material weaknesses in internal control over financial reporting described below under the caption “—Material Weakness in Internal Control Over Financial Reporting.”

Management’s Report on Internal Control Over Financial Reporting

As of December 31, 2023, our management carried out an evaluation, under the supervision and with the participation of our CEO and CFO, of the effectiveness of the design and operation of our controls over financial reporting and procedures using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control-Integrated Framework (2013). Based on the foregoing evaluation, our management concluded that our internal controls over financial reporting were not effective because of the material weaknesses identified in our internal control over financial reporting discussed below, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

Material Weakness in Internal Control Over Financial Reporting

As of December 31, 2023, the following material weaknesses have been identified:

•Information technology general controls (ITGCs) were not designed and operating effectively to ensure (i) that access to applications and data, and the ability to make program and job changes, were adequately restricted to appropriate personnel and (ii) that the activities of individuals with access to modify data and make program and job changes were appropriately monitored. Business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted;

•Ineffective design, implementation, and documentation of management review controls related to the valuation of inventory.

While the control deficiencies did not result in a material misstatement to the Company’s consolidated financial statements for the year ending December 31, 2023, they did represent material weaknesses as of December 31, 2023, since there existed a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements would not be prevented or detected on a timely basis.

Management’s Remediation Measures

Management is committed to maintaining a strong internal control environment. In response to the identified material weaknesses, management, with the oversight of the Audit Committee of the Board of Directors, has taken a number of remediation actions during the year ending December 31, 2023, and continues to address these deficiencies. The Company will not be able to conclude that the material weaknesses are remediated until the applicable controls operate for a sufficient period of time and management has concluded, through formal testing, that the controls are operating effectively. Remediation actions taken include the following:

Information technology:

• The Company continued to strengthen the design and implementation of logical access, change management, and IT operation controls through proper segregation of duties, monitoring controls, and the development of controls around critical jobs.

• The Company procured IT subject matter experts and created an Identity and Access Management team within Information Security to improve ownership and consistency of control execution including the user provisioning process and quarterly user access reviews.

• The Company implemented a formal management training and remediation program, which has promoted risk-based prioritization of remediating findings and a mechanism to track continuous improvement.

Inventory valuation:

The Company created a robust management review control process to:

•Document steps taken by management to perform the review, assess reasonableness, and investigate matters;

•Apply the appropriate level of precision and defined criteria to drive review and investigative procedures;

•Evidence the performance of each management review activity prescribed in the control; and

•Improve the validation of the completeness and accuracy of key reports used in inventory valuation controls.

The Company hired additional resources including:

•Additions to our cost accounting team with appropriate technical knowledge to support inventory accounting requirements;

•A leadership resource to lead internal controls efforts; and

•External resources to assist in the remediation efforts and internal control execution, as well as additional training to personnel.

Attestation Report of Independent Registered Public Accounting Firm

Marcum LLP, an independent registered public accounting firm has issued an attestation report on the effectiveness of our internal control over financial reporting as of December 31, 2023, which report follows below.

Changes in Internal Control Over Financial Reporting

Other than the ongoing remediation measures discussed above, there have been no other changes in our internal control over financial reporting (as defined in Rules13a-15(f) and 15d-15(f) under the Exchange Act) which occurred during the quarter ended December 31, 2023, that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.