Company: CRLBF
Filing Date: 2025-03-14
Form Type: 40-F
Source: 0001832928-25-000006
Chunk: 6

Company: Cresco Labs Inc.
Filing Date: 2025-03-14
Form: 40-F
Chunk 6
---
 increase transactional level data risk for key activity level controls downstream. System implementation changes to existing systems lack an approved policy and established approval methodology. The Company also had control deficiencies with service organization control report reviews and automated job monitoring.

• Information Produced by the Entity (“IPE”) Controls: As a result of upstream ITGC related material weaknesses, the Company’s downstream financial controls had design weaknesses unable to independently verify system generated IPE. These ITGC and IPE material weaknesses impact substantially all key activity level controls at the relevant assertion levels within the financial reporting cycles impacting financial assertions within the Company’s consolidated financial statements.

• Controls over Account Reconciliation: Since inception, the Company has experienced rapid growth both organically and from various acquisitions. In addition to the ITGC and IPE weaknesses noted above, the growth and numerous changes resulted in a lack of sufficient resources to adequately perform and maintain account reconciliation and review controls at the relevant assertion levels within the financial and reporting cycles impacting the Company’s consolidated financial statements.

Though no material errors were identified from the above issues in the consolidated financial statements for the year ended December 31, 2024, these material weaknesses create a reasonable possibility that material misstatements in the financial statements would not be prevented or detected on a timely basis. Management remains committed to maintaining a strong internal control environment. In response to the identified material weaknesses, management, with the oversight of the Audit Committee, will continue to channel resources towards remediating these key issues.

Remediation of Material Weaknesses in Internal Control over Financial Reporting

Management has initiated, and will continue to implement, remediation plans related to the material weaknesses identified. Management believes these measures, and others that may be implemented, will remediate the material weaknesses in ICFR described above. Management’s primary remediation efforts initiated in 2023 and continuing into 2025 are focused on improving the reconciliation processes and simplifying subledger accounts. Additionally, management has taken several steps to remediate ITGC deficiencies identified, which include reimplementing policies and procedures for user access review and change management for all critical systems and improving system access security through continued single sign-on (“ SSO ”) enabling of non-SSO critical systems. We will continue to monitor and evaluate the effectiveness of our internal controls and procedures over financial reporting on an ongoing basis and are committed to taking further action and implementing additional improvements as necessary and as cost-benefit is justified.

#### Limitations on Effectiveness of Controls
The Company’s ICFR may not prevent all errors and all fraud. A