CNB FINANCIAL CORP/PA

ITEM 4

CONTROLS AND PROCEDURES

The Corporation's management, under the supervision of and with the participation of the Corporation's Principal Executive Officer and Principal Financial Officer, has carried out an evaluation of the design and effectiveness of the Corporation's disclosure controls and procedures as defined in Rule 13a-15(e) and Rule 15d-15(e) of the Securities Exchange Act of 1934, as amended, as of the end of the period covered by this report. Based upon that evaluation, management, including the Principal Executive Officer and Principal Financial Officer, have concluded that, as of the end of such period, the Corporation's disclosure controls and procedures are effective to provide reasonable assurance that all material information required to be disclosed in reports the Corporation files or submits under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported, within the time periods specified in the Securities and Exchange Commission's rules and forms.

In conducting the evaluation of the effectiveness of its internal control over financial reporting as of September 30, 2025, the Corporation has excluded the operations of ESSA and its subsidiaries as permitted by the guidance issued by the Office of the Chief Accountant of the Securities and Exchange Commission (not to extend more than one year beyond the date of the acquisition or for more than one annual reporting period). In conducting the evaluation of the effectiveness of its disclosure controls and procedures as of September 30, 2025, the Corporation has excluded those disclosure controls and procedures of ESSA that are subsumed by internal control over financial reporting. The Merger was completed on July 23, 2025. As of and for the quarter ended September 30, 2025, ESSA’s assets represented approximately 25 percent of the Corporation’s consolidated assets. See "Note 3, Business Combination" for further discussion of the Merger and its impact on the Corporation’s condensed consolidated financial statements.

The design of any system of controls and procedures is based in part upon certain assumptions about the likelihood of future events. There can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions, regardless of how remote.

Changes in Internal Control over Financial Reporting

During the third quarter of 2025, ESSA merged into CNB Financial Corporation. The Corporation is working to integrate ESSA into its overall internal control over financial reporting processes. Except for changes made in connection with this integration of ESSA, there was no change in the Corporation's internal control over financial reporting that occurred during the third quarter of 2025 that has materially affected, or is likely to materially affect, the Corporation's internal control over financial reporting.