Company: CRLBF
Filing Date: 2025-03-14
Form Type: 40-F
Source: 0001832928-25-000006
Chunk: 5

Company: Cresco Labs Inc.
Filing Date: 2025-03-14
Form: 40-F
Chunk 5
---
 SEC’s rules and forms and includes, without limitation, controls and procedures designed to ensure that such information is accumulated and communicated to the issuer’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

As of the end of the period covered by this report, our management carried out an evaluation, with the participation of our Chief Executive Officer (“ CEO ”) and Chief Financial Officer (“ CFO ”), of the effectiveness of our disclosure controls and procedures. Based upon that evaluation, our CEO and CFO concluded that the Company’s disclosure controls and procedures, as defined in Rule 13a-15(e), were not effective as of such date, as a result of the material weaknesses in our internal control described below.

### INTERNAL CONTROL OVER FINANCIAL REPORTING
Management of the Company is responsible for establishing adequate internal control over financial reporting (“ ICFR”) . ICFR is designed by, or under the supervision of, the Company’s CEO and CFO and effected by the Company’s board of directors, management, and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP. Because of its inherent limitations, ICFR may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

The Company’s management, including the Company’s CEO and CFO, assessed the effectiveness of the Company’s ICFR as of December 31, 2024, based on the criteria set forth in the Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, management concluded that, as of December 31, 2024, the Company’s ICFR was not effective because of material weaknesses identified in our ICFR discussed below, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. Identified material weaknesses are as follows:

• Information Technology General Controls (“ITGCs”): ITGCs for financial impacting applications contained design deficiencies within logical access and change management. The logical access issues included testing for new and modified user access provisioning, modifying access, terminated users, and periodic access reviews (including privileged access). ITGC provisioning issues