ARROW FINANCIAL CORP

Item 4.

CONTROLS AND PROCEDURES

Management, under the supervision and with the participation of the Chief Executive Officer ("CEO") (who is our principal executive officer) and Chief Financial Officer ("CFO") (who is our principal financial officer), evaluated the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d15(e) of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of March 31, 2024. The term "disclosure controls and procedures" means controls and other procedures of a company that are designed to ensure that:

•information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms; and

•information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to management, including the principal executive and principal financial officers, or persons and committees performing similar functions, such as the Audit Committee, as appropriate to allow timely decisions regarding required disclosure.

Based on this evaluation, management concluded that our internal control over financial reporting was not effective due to the following unremediated material weaknesses identified in our internal control over financial reporting, previously disclosed on the 2023 Form 10-K:

•We did not maintain effective monitoring controls related to 1) Internal Audit’s testing of management’s internal control over financial reporting, 2) the completeness and accuracy of information presented to the Audit Committee by Internal Audit, and 3) the related Audit Committee oversight over Internal Audit’s testing of management’s internal control over financial reporting.

•With regard to the conversion of our core banking information technology system, we did not effectively perform risk assessment procedures to identify the impact of the conversion on our internal control over financial reporting.

The material weaknesses did not result in a material misstatement of our annual or interim financial statements or previously released financial results.For additional information please refer to Part II - Item 9A. of the 2023 Form 10-K.

Prior to filing this Report, we performed relevant and responsive substantive procedures as of March 31, 2024, in order to complete our financial statements and related disclosures. Based on these procedures, management believes that our consolidated financial statements included in this Report have been prepared in accordance with GAAP. Our CEO and CFO have certified that, based on their knowledge, the financial statements, and other financial information included in this Form 10-Q, fairly present in all material respects the financial condition, results of operations, and cash flows of the Company as of the dates, and for the periods presented in this Report.

Remediation Efforts to Address the Material Weaknesses

The aforementioned material weaknesses were previously disclosed in the 2023 and 2022 Forms 10-K. While the Company has improved its organizational capabilities and implemented necessary remediation measures, the remediation steps taken were not in place for a sufficient amount of time for the material weaknesses to be considered remediated as of March 31, 2024. Accordingly, the Company will continue to monitor its remediation measures in the remaining quarters of 2024 in order to confirm effective remediation of the identified material weaknesses.

During the year ended December 31, 2023 and through the three months ended March 31, 2024, management initiated and/or completed the following remedial actions:

•The Company evaluated the assignment of responsibilities of internal and external resources associated with the performance of internal controls over financial reporting and hired additional resources, contracted external resources, and/or provided additional training to existing resources as appropriate. In addition, we have initiated a process to identify and maintain the information required to support the functioning of internal control.

•Audit Committee and management implemented the following actions to improve the monitoring activities related to Audit Committee oversight over Internal Audit’s testing of management’s internal control over financial reporting:

◦Increased the frequency and depth of reporting to the Audit Committee through the creation of a sub-committee of Audit Committee members that meet in the months in which the full Audit Committee does not have scheduled meetings or as needed.

◦Instituted more frequent Audit Committee meetings to facilitate timely review of matters related to the results of the Company’s monitoring program and Internal Audit’s progress against their plan as well as status of control testing results.

◦Developed a comprehensive internal audit strategy and program to test management’s controls over financial reporting.

◦Developed a robust reporting mechanism to ensure the completeness, accuracy and improved effectiveness of information which is presented on a timely basis to the Audit Committee to help fulfill the Audit Committee's oversight responsibilities.

◦Utilized monthly dashboards to report status and results of internal audits as well as operations of internal controls over financial reporting.

◦Engaged a professional services firm to review the Company’s control program required by the Sarbanes-Oxley Act of 2002, as amended, and assist Management with its overall Company-wide processes and with selecting and developing control activities designed to mitigate risks and support achievement of control objectives.

•Performed a thorough risk assessment to identify the impact of the core banking system conversion on our internal control over financial reporting. As a result, the company identified the need for additional controls to mitigate risks and support the achievement of control objectives. These controls are being implemented as part of the ongoing, overall remediation efforts.

The actions that we are taking are subject to ongoing management review and Audit Committee oversight to ensure they remain in place and continue to operate in order to be deemed effective.

Changes in Internal Control Over Financial Reporting

Except for the remediation measures in connection with the material weaknesses described above, there were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act, during the quarter ended March 31, 2024 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.