AEON Biopharma Inc

Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures are designed to ensure that information required to be disclosed by us in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specific in the SEC rules and forms, and that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Per Rules 13a-15(e) and 15d-15(e), the term disclosure controls and procedures means controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Exchange Act (15 U.S.C. 78a et seq.) is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Exchange Act is accumulated and communicated to the issuer’s management, including its Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Our Chief Executive Officer and Chief Financial Officer (“certifying officers”) have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of December 31, 2023. Our certifying officers concluded that, as a result of the material weaknesses in internal control over financial reporting as described below, our disclosure controls and procedures were not effective as of December 31, 2023.

Management’s Annual Report on Internal Control over Financing Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a-15(f) under the Exchange Act. Under the supervision and with the participation of senior management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of our internal control over financial reporting based on the framework in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework). Based on the evaluation under that framework and applicable SEC rules, our management concluded that our internal control over financial reporting was not effective as of December 31, 2023 as a result of the material weaknesses in internal control over financial reporting as described below.

Our certifying officers concluded that the Company did not have an effective risk assessment over complex transactions due to the lack of sufficient and qualified resources. This led to a deficiency in the design and implementation of controls to review data inputs used in the valuation of financial instruments. The material weaknesses resulted in a restatement of our financial statements as described in the Explanatory Note to the Quarterly Report Form 10Q/A filed on March 29, 2024.

Additionally, as previously disclosed, on July 21, 2023, AEON completed a Merger with Old AEON and Merger Sub, pursuant to which Merger Sub merged with and into Old AEON, with Old AEON surviving the merger as a wholly-owned subsidiary of AEON. Prior to the Merger, Priveterra was a special purpose acquisition company formed for the purpose of effecting a merger, capital stock exchange, asset acquisition, stock purchase, reorganization, or other similar business combination with one or more target businesses. As a result, previously existing internal controls are no longer applicable or comprehensive enough as of the assessment date considering the Company’s operations prior to the Merger were insignificant compared to those of the Post-Combination Company. The design and implementation of internal controls over financial reporting for the Post-Combination Company has required and will continue to require significant time and resources from management and other personnel.

Based on our assessment, we have continued to identify a material weakness in connection with Priveterra’s internal controls around the interpretation and accounting for extinguishment of a significant contingent obligation as of December 31, 2022 that were not effectively designed or maintained.

Remediation Status of Material Weaknesses in Internal Control over Financial Reporting

We plan to enhance our processes by designing and implementing controls to review the results of valuations and estimates, including the completeness and accuracy of relevant data elements included in the valuation or estimate. We also plan to engage additional qualified resources and/or hire additional staff to ensure these incremental controls are properly implemented.

Management continues to be actively engaged to take steps to remediate the material weaknesses, including transition of financial reporting responsibilities from Priveterra to AEON and enhanced processes to identify and appropriately apply applicable accounting requirements to better evaluate and understand the nuances of the complex accounting standards that apply to our consolidated financial statements, providing enhanced access to accounting literature, research materials and documents, and increased communication among our personnel and third-party professionals with whom we consult regarding complex accounting applications.

Changes in Internal Control over Financial Reporting

Management has continued to take action to remediate the material weaknesses during the annual period ended December 31, 2023. However, the material weaknesses will not be considered remediated until management designs and implements effective controls that operate for a sufficient period of time and management has concluded, through testing, that these controls are effective.

Other than described above, there has not been any changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15(d)-15(f) under the Exchange Act) during the year to which this Report relates that have materially affected or are reasonably likely to materially affect our internal control over financial reporting.

Inherent Limitations of Internal Controls

Our management, including our chief executive officer and chief financial officer, does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent all errors and all fraud due to inherent limitations of internal controls. Because of such limitations, there is a risk that material misstatements will not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.