BuzzFeed Inc

Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures are designed to ensure that information required to be disclosed by us in our reports under the Securities Exchange Act of 1934, as amended (the “Exchange Act”) is recorded, processed, summarized and reported within the time periods specified in the rules and forms of the U.S. Securities and Exchange Commission, and that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act) as of the end of the period covered by this report. In making this evaluation, management considered the material weaknesses in our internal controls over financial reporting described below. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of December 31, 2023, the period covered in this report, our disclosure controls and procedures were not effective.

Notwithstanding the assessment that our disclosure controls and procedures are not effective and that material weaknesses existed as of December 31, 2023, we believe that we have performed sufficient supplementary procedures to ensure that the consolidated financial statements contained in this filing fairly present, in all material respects, our financial position, results of operations and cash flows for all periods presented, in accordance with U.S. Generally Accepted Accounting Principles.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). Our management is also required to assess and report on the effectiveness of our internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act of 2002. Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (i.e., COSO) in Internal Control - Integrated Framework. Based on that evaluation, our management concluded the Company’s internal control over financial reporting was not effective due to the material weaknesses described below.

Previously Disclosed Material Weaknesses in Internal Control over Financial Reporting.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

In preparing the financial statements as of, and for the years ended, December 31, 2022 and 2021, we identified material weaknesses in our internal control over financial reporting, which remain unremediated as of, and for the year ended, December 31, 2023. The material weaknesses identified in our internal control over financial reporting related to: (i) a lack of formalized internal controls and segregation of duties surrounding our financial statement close process, and (ii) a lack of formalized information technology (“IT”) general controls in the area of change management and logical security controls over financial IT systems. The remediation of these deficiencies has required, and will continue to require, a significant amount of time and resources from management and other personnel.

Management’s Remediation Plan

(a) A Lack of Formalized Internal Controls and Segregation of Duties Surrounding our Financial Statement Close Process:

During 2023, with the oversight of the audit committee of our board of directors, we began implementing remediation plans and enhanced controls within the financial statement close process, including documentation improvements for certain higher risk and material balance sheet reconciliation schedules and supporting financial calculations and analyses. However, certain business process controls were not designed, or did not operate at the appropriate level of precision, to prevent or detect a material misstatement, and conflicts with respect to segregation of duties were identified across our end-to-end financial statement close process. Our management will continue to implement remediation plans to define control procedures, enhance documentation, and enforce segregation of duties to ensure controls are adequately designed and operate sufficiently including, but not limited to: enhancing certain higher risk balance sheet reconciliation schedules, completeness and accuracy, and related review procedures; enhancing review procedures with respect to financial results and supporting financial calculations; designing processes and controls to adequately segregate job responsibilities; redesigning workflow approval routing and security permissions; and reducing reliance on manual controls.

(b) A Lack of Formalized Information Technology General Controls in the Area of Change Management and Logical Security Controls Over Financial Information Technology Systems:

During 2023, our management began implementing remediation plans to address certain control deficiencies around system development and change management and IT security, including formalizing the processes and controls around security administration and implementing user access reviews for certain key financial systems. However, we did not have sufficient resources with technical expertise to centralize certain IT functions and to provide adequate IT oversight over financial systems.

Our management intends to revisit its IT sustainment plan to further support and provide appropriate oversight over key financial systems, and intends to implement remediation plans, including, but not limited to: centralizing the change management and security administration function; implementing policies and procedures with respect to change management, system development, and application-level security; documenting test procedures and approvals relating to changes made to production; maintaining separate development, test, and production environments; formalizing controls around security administration; and implementing real-time monitoring.

Remediation of Previously Reported Material Weakness

In preparing the financial statements as of, and for the years ended, December 31, 2022 and 2021, we previously identified a material weakness in our internal control over financial reporting, which related to ineffective upstream processes for gathering critical data to support a formalized assessment and review of certain technical accounting matters. As of December 31, 2023, our management completed the following actions designed to remediate the material weakness evidenced by: enhanced collaboration, awareness and communication across departments to help identify and report significant, complex and contracts containing non-standard terms; recurring end-user training to reinforce timely communication and reporting of certain contracts; enhanced documentation to demonstrate management’s revenue recognition assessments and conclusions; and more robust review controls to ensure proper revenue recognition.

Based on the above actions taken to strengthen our internal control over financial reporting as it relates to the communication of critical data and documentation of technical accounting assessments, and in conjunction with the results of our testing over the design and operating effectiveness of the relevant controls, management has deemed the previously identified material weaknesses as remediated.

Changes in Internal Control over Financial Reporting

Other than the remediation of the material weakness and ongoing remediation efforts described above, there were no changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act) during the year ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on the Effectiveness of Controls

The effectiveness of any system of internal control over financial reporting, including ours, is subject to inherent limitations, including the exercise of judgment in designing, implementing, operating, and evaluating the controls and procedures, and the inability to eliminate misconduct completely. Accordingly, in designing and evaluating the disclosure controls and procedures, our management recognizes that any system of internal control over financial reporting, including ours, no matter how well designed and operated, can only provide reasonable, not absolute assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. We intend to continue to monitor and upgrade our internal controls as necessary or appropriate for our business but cannot assure you that such improvements will be sufficient to provide us with effective internal control over financial reporting.