CarGurus Inc

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Principal Executive Officer and Principal Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act), as of the end of the period covered by this Quarterly Report.

The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and our management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

As described below, based on the evaluation of our disclosure controls and procedures as of the end of the period covered by this Quarterly Report, management identified a material weakness in our internal control over financial reporting. As a result of the material weakness, our Principal Executive Officer and Principal Financial Officer have concluded that, as of such date, our disclosure controls and procedures were not effective to provide reasonable assurance that information required to be disclosed in the reports we file and submit under the Exchange Act is recorded, processed, summarized, and reported as and when required.

Notwithstanding this material weakness noted above, our management, including our Principal Executive Officer and Principal Financial Officer, has concluded that our financial statements included in this Quarterly Report present fairly, in all material respects, our financial position, results of operations, and cash flows for the periods presented in accordance with GAAP.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

The control deficiencies, which, in the aggregate, were assessed as a material weakness as disclosed in our Annual Report, have not yet been fully remediated.

At December 31, 2023, we had unremediated operational control deficiencies at CarOffer associated with the operation of logical access and change management of information technology, or IT, general controls, or IT General Controls around program change and logical access in certain IT systems. Therefore, we were not able to have consistent, effective operation of manual controls that rely on data produced by and maintained within these affected IT systems. As of March 31, 2024, management was unable to demonstrate the consistent, effective operation of IT General Controls and manual controls that rely on data produced by and maintained within affected IT systems due to the limited remediation period. As a result, we did not have effective operation of internal controls over financial reporting to address the risks of material misstatement of various financial statement accounts at March 31, 2024. Management has determined that the impact of the previously identified deficiencies continue to aggregate into a material weakness at March 31, 2024.

This material weakness did not result in a known material misstatement to our financial statements. However, the material weakness could have resulted in material misstatements in our interim or annual financial statements and disclosures which then may not have been prevented or detected. The material weakness also impacts the effectiveness of segregation of duties, impacts the effectiveness of financial controls which rely on information from relevant financial systems, and increases the reliance on corporate accounting personnel to identify errors at the CarOffer subsidiary level.

Remediation Plan

To address the material weaknesses in our internal control over financial reporting as of December 31, 2023, we have continued remediation efforts outlined in previous financial statements, as applicable, including enhancing our control procedures, and in some cases, increasing the frequency at which controls are performed for logical access in IT systems. In addition, until remediation steps have been completed and are operated for a sufficient period of time, and subsequent evaluation of their effectiveness is completed, the material weakness described above will continue to exist. Our ongoing remediation efforts are focused on continued employee training related to internal control over financial reporting and confirming sustained operation of effectively designed control activities, including IT General Controls.

Management is committed to successfully implementing the remediation plan as promptly as possible. As of March 31, 2024, management has implemented or enhanced certain controls to address specific issues related to the material weakness. The material weakness will not be considered remediated until our management implements effective controls that operate for a sufficient period of time and our management has concluded through testing that these controls are effective. The elements of our remediation plan can only be accomplished over time, and we can offer no assurance that these initiatives will ultimately have the intended effects. See “Risk Factors—Risks Related to Our Business and Industry—We have identified a material weakness in our internal control over financial reporting. If we are unable to remediate this material weakness, we may not be able to accurately or timely report our financial condition or results of operations, which may adversely affect our business and the market price of our common stock.”in Part I, Item 1A in our Annual Report.

Changes in Internal Control over Financial Reporting

Except as otherwise noted above under "Remediation Plan," including the on-going remediation efforts described, there were no changes in our internal control over financial reporting (as such term is defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) during the period covered by this Quarterly Report that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. Our plans for remediating the material weakness, described above, will constitute changes in our internal control over financial reporting, prospectively, when such remediation plans are effectively implemented.