RCI HOSPITALITY HOLDINGS INC

Evaluation of Disclosure Controls and Procedures

In connection with the preparation of this report, an evaluation was carried out by certain members of Company management, with the participation of the Chief Executive Officer (“CEO”) and the Chief Financial Officer (“CFO”) of the effectiveness of the Company’s disclosure controls and procedures (as defined in Securities and Exchange Commission’s (“SEC”) Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934 (“Exchange Act”) as of September 30, 2024. Disclosure controls and procedures are designed to ensure that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including the CEO and the CFO, to allow timely decisions regarding required disclosures.

Due to material weaknesses in internal control over financial reporting described below, management concluded that the Company’s disclosure controls and procedures were not effective as of September 30, 2024. Notwithstanding the existence of these material weaknesses, management believes that the consolidated financial statements in this annual report filed on Form 10-K present, in all material respects, the Company’s financial condition as reported, in conformity with United States Generally Accepted Accounting Principles (“U.S. GAAP”).

Management’s Annual Report on Internal Control over Financial Reporting

Management of the Company is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) under the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP and includes those policies and procedures that: (1) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect our transactions and the dispositions of our assets; (2) provide reasonable assurance that our transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP and that our receipts and expenditures are being made only in accordance with appropriate authorizations; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our consolidated financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Under the supervision of and with the participation of our management, we assessed the effectiveness of our internal control over financial reporting as of September 30, 2024, using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control—Integrated Framework (2013). A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis. We have identified material weaknesses in internal control related to (1) ineffective design and operation of controls over certain information technology general controls ("ITGCs"), including program change management, user access, and vendor management controls; (2) ineffective design and operation of controls, which include management review controls, over the accounting for business combinations; and (3) ineffective design and operation of controls, which include management review controls, over the Company's assessments of potential impairment. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were a result of inadequate IT controls over the review of user access and imprecise documentation of procedures related to program change management. Additionally, we rely upon a variety of outsourced IT service providers for key elements of the technology infrastructure impacting our financial reporting process. Certain outsourced IT service providers could not provide System and Organization Controls ("SOC") reports for periods that closely align with our fiscal year end. Given that management did not effectively assess the design and operation of these outsourced IT service providers’ internal controls, some of our controls over IT systems and business processes were also deemed ineffective, but only to the extent that we rely upon information that was subject to the outsourced IT service providers’ control environment. These deficiencies may have an impact on our financial statements, account balances, and disclosures. Based on our evaluation, our management, with the participation of our chief executive officer and chief financial officer, concluded that our internal control over financial reporting was not effective as of September 30, 2024.

Following identification of these material weaknesses, and prior to filing this Annual Report on Form 10-K, we completed substantive procedures for the year ended September 30, 2024. Based on these procedures, management believes that the consolidated financial statements included in this Form 10-K have been prepared in accordance with U.S. GAAP. Our CEO and CFO have certified that, based on their knowledge, the financial statements, and other financial information included in this Form 10-K, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Form 10-K.

The Company’s independent registered public accounting firm, Marcum LLP, has expressed an unqualified opinion on our consolidated financial statements and an adverse opinion on our internal control over financial reporting as of September 30, 2024, in the audit report that appears at the end of Part II of this Annual Report on Form 10-K.

Remediation Plan for Existing Material Weaknesses

Management is committed to the remediation of the material weaknesses described above.

Review of Accounting for Business Combinations

Controls will be added to both increase precision of management’s review of each component of business combinations, and if necessary, retain the services of a third-party consultant to assist in the valuation and accounting for intangible assets acquired in a business combination.

Review of Accounting for Impairment of Goodwill and Intangible Assets

As most of the assumptions used in the valuation models employed in impairment analyses are subjective in nature, Management will employ additional controls to validate these assumptions, including the engagement of a third-party consultant to assist developing valuation models and establishing sound and reasonable assumptions.

Information Technology General Controls

As a result of the material weakness, we have initiated and will continue to implement remediation measures to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) strengthening and enhancing the review and documentation procedures in our controls over user access review; (ii) defining and communicating clear and concise program change management policy and procedures; (iii) enhancing the reporting requirements of accounting system audit logs; (vi) continuous improvement over our ITGC controls related to third party applications; and (vi) enhanced quarterly reporting on the remediation measures to the Audit Committee of the board of directors.

It is our belief that these added controls will effectively remediate the existing material weaknesses.

The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We expect that the remediation of these material weaknesses will be completed prior to the end of fiscal 2025.

Changes in Internal Control Over Financial Reporting

Except for the remediation efforts as discussed above, there have been no other changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during the quarter ended September 30, 2024 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.