Company: CRLBF
Filing Date: 2025-03-14
Form Type: 40-F
Source: 0001832928-25-000006
Chunk: 7

Company: Cresco Labs Inc.
Filing Date: 2025-03-14
Form: 40-F
Chunk 7
---
 control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, will be detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additional controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls.

The design of any system of controls is also based, in part, upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions in the Company’s business, including increased complexity resulting from the Company’s growth and acquisitions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected on a timely basis, notwithstanding the remediation of the material weaknesses.

Changes to the Company’s Internal Control over Financial Reporting.

As previously reported in the Company’s Annual Report on Form 40-F for the year ended December 31, 2023, management’s assessment of the effectiveness of the Company’s ICFR concluded that, as of December 31, 2023, the Company’s ICFR was not effective as a result of material weaknesses associated with disaster recovery and business continuity. The Company’s disaster recovery and business continuity lacked an approved policy and established procedures in the event of incident. Additionally, the Company lacked a methodology to test the effectiveness of disaster recovery and business continuity for all critical systems on a periodic basis.

To address the material weaknesses in the Company’s ICFR, management implemented a disaster recovery and business continuity policy. Further, the Company established a testing methodology the test effectiveness of the disaster recovery and business continuity policy.

Except for the material weaknesses and the remediation efforts described above, no other changes to the Company’s ICFR during the year ended December 31, 2024 have materially affected, or are likely to materially affect, the Company’s ICFR.

###