Ovid Therapeutics Inc

Management’s Evaluation of our Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to ensure that information required to be disclosed in the reports that we file or submit under the Securities Exchange Act of 1934, as amended (the “Exchange Act”) is (1) recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms and (2) accumulated and communicated to our management, including our principal executive officer and principal financial officer, to allow timely decisions regarding required disclosure.

As of September 30, 2024, our management, with the participation of our principal executive officer and principal financial officer, evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act). Our management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives, and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Our principal executive officer and principal financial officer have concluded based upon the evaluation described above that, as of September 30, 2024, our disclosure controls and procedures were not effective.

In light of the material weaknesses described below, management performed additional analysis and other procedures to ensure that our consolidated financial statements were prepared in accordance with U.S. Generally Accepted Accounting Principles (“GAAP”). Accordingly, management believes that the consolidated financial statements included in this Quarterly Report on Form 10-Q fairly present, in all material respects, our financial position, results of operations, and cash flows as of and for the periods presented, in accordance with GAAP.

Identification of Material Weaknesses

Based on the evaluation of the effectiveness of our disclosure controls and procedures, our principal executive officer and principal financial officer concluded that the Company did not have sufficiently trained resources in emerging and evolving threats related to spear phishing, vendor email compromise, and other cyber attack approaches and designing and implementing controls over changes to vendor payment information. As a result, we were unable to maintain effective risk assessment and information and communication processes, and did not have effective process-level control activities over changes to vendor payment information.

The control deficiencies described above created a reasonable possibility that a material misstatement to the consolidated financial statements would not be prevented or detected on a timely basis. Therefore, we concluded that the deficiencies represent material weaknesses in the Company’s internal control over financial reporting.

During the quarter ended September 30, 2024, the control deficiencies described above resulted in the Company not identifying and preventing a criminal scheme involving a business email compromise at one of its development partners, which led to a fraudulent transfer of $1.8 million to a third-party impersonating one of its development partners. We self-discovered this fraudulent activity and promptly initiated contact with our bank as well as appropriate law enforcement authorities in an effort to, among other things, recover the transferred funds. To date, we have not found any evidence of additional fraudulent activity.

Remediation Plan

Immediately following the incident, we initiated a reassessment of our processes and developed an action plan to remediate the identified weaknesses. This included replacing personnel on the accounting team with a newly added resource. Additionally, we are executing the following steps until remediation of the material weaknesses is achieved:

•performing additional investigative and confirming procedures;

•enhancing the design of vendor information change controls;

•implementing new controls over the approval requirements and review for ACH and wire transfers;

•increasing internal communication and training to heighten awareness and emphasize the importance of exercising professional skepticism and judgment as it relates to spear phishing, vendor email compromise and other cyber attack approaches; and

•reporting regularly to the Audit Committee of the Board of Directors of the Company on the progress and results of the remediation plan, including the identification, status and resolution of internal control deficiencies.

Changes in Internal Control over Financial Reporting

Except as described above, there have been no other changes in our internal control over financial reporting during our most recent quarter ended September 30, 2024 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.