CareDx Inc

Evaluation of Disclosure Controls and Procedures

Management, including our principal executive officer and principal financial officer, evaluated the effectiveness of our disclosure controls and procedures, as such terms are defined in Rules 13a-15(e) and 15d-15(e) promulgated under the Exchange Act, as of December 31, 2023. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs. Based on such evaluation, our principal executive officer and principal financial officer concluded that, as of December 31, 2023, in light of the material weaknesses identified in our internal control over financial reporting, our disclosure controls and procedures were not effective at the reasonable assurance level and are not effective to provide reasonable assurance that information required to be disclosed in the reports we file and submit under the Exchange Act, is (i) recorded, processed, summarized and reported as and when required and (ii) accumulated and communicated to our management, including the principal executive officer and principal financial officer, as appropriate to allow timely discussion regarding required disclosure.

Management’s Annual Report on Internal Control over Financial Reporting

Management, including our principal executive officer and principal financial officer, is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control system was designed to provide reasonable assurance regarding the preparation and fair presentation of published consolidated financial statements in accordance with accounting principles generally accepted in the United States.

Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission, or COSO, in the 2013 Internal Control-Integrated Framework. Based on our assessment, management has concluded that our system of internal control over financial reporting was not effective due to the material weaknesses described below. However, after giving full consideration to these material weaknesses, and the additional analyses and other procedures we performed to ensure that our consolidated financial statements included in this Annual Report on Form 10-K were prepared in accordance with U.S. generally accepted accounting principles, or GAAP, our management has concluded that our consolidated financial statements present fairly, in all material respects, our financial position, results of operations and cash flows for the periods disclosed in conformity with GAAP.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As of December 31, 2023, the following material weaknesses have been identified:

General Information Technology Controls. We did not design and maintain effective general information technology controls, or GITCs, for information systems and applications that are relevant to the preparation of the consolidated financial statements. Specifically, we did not design and maintain: (i) sufficient user access controls to ensure appropriate segregation of duties, logical access controls to prevent unauthorized user access and adequately restrict user and privileged access to financial applications, programs and data to appropriate Company personnel; (ii) program change management controls to ensure that information technology, or IT, program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately with appropriate segregation of duties; and (iii) computer and network operations controls to ensure that batch and interface jobs are monitored and privileges are appropriately granted, authorized and monitored. As a result, business process controls (automated and manual) that are dependent on the ineffective GITCs, or that rely on data produced from systems impacted by the ineffective GITCs, are also deemed ineffective, which affects substantially all financial statement account balances and disclosures.

Purchase Order Approval Workflow. We did not design and maintain effective process-level control activities related to procurement to ensure appropriate approval of purchase orders, which could affect the amount and classification of costs capitalized or expensed.

COSO Framework. We did not fully maintain components of the COSO framework, including elements of the control environment, information and communication, and control activities and monitoring activities components, relating to: (i) sufficiency of competent personnel to perform internal control activities and support the achievement of our internal control objectives; (ii) enforcing accountability of personnel for the performance of their internal control responsibilities across the organization in the pursuit of objectives; (iii) designing and maintaining general control activities over technology to support the achievement of our internal control objectives; (iv) performing control activities in accordance with established policies in a timely manner; and (v) performing sufficient reviews of information to assess its relevance, accuracy, and completeness in supporting the internal control components. As such, our management concluded that we did not have an adequate process in place to complete its assessment of the design and operating effectiveness of internal control over financial reporting in a timely manner.

Remediation of Prior Year Material Weaknesses

As disclosed in Part II, Item 9A of our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 27, 2023, we previously identified material weaknesses related to GITCs, purchase order approval workflow and the COSO framework.

During the fiscal year ended December 31, 2023, we implemented an intensive program to remediate the previously identified material weaknesses, which included expanding resources, including hiring a Chief Information and Security Officer in the third quarter of 2023, enhancing our control activities for key systems and business processes, and providing training. In addition, we performed manual procedures to validate the completeness and accuracy of the reports generated from the systems that are relevant to the preparation of the consolidated financial statements that did not have effective GITCs.

While we believe that we have completed updates to the control design for the majority of our systems and purchase order approval workflow in response to the identified material weaknesses, the redesigned controls did not operate for a sufficient period of time for management to reach a conclusion regarding the operating effectiveness of the controls that were redesigned in the fiscal year ended December 31, 2023.

However, our management concluded these material weaknesses did not result in any material misstatement in our financial statements or disclosures for the fiscal year ended December 31, 2023.

Our management is committed to maintaining a strong internal control environment. In response to the material weaknesses described above, our management is continuing to take actions to remediate the material weaknesses in internal control over financial reporting, which include but are not limited to the following:

•Continuing to enhance the design and control procedures of the GITCs to ensure that the control activities related to GITCs are functioning appropriately.

•Continuing to implement training to ensure a clear understanding of risk assessment, control execution, and monitoring activities related to financial reporting and continue driving accountability of Sarbanes-Oxley Act of 2002 control activities.

•Continuing to focus on controls execution and monitoring activities of internal controls related to the procure-to-pay process.

•Continuing to expand the available resources at the Company with experience designing and implementing control activities, including GITCs, through hiring and use of third-party consultants and specialists.

We are committed to continuing to implement a strong system of controls and believe that our ongoing remediation efforts, particularly in the improvement of our control environment, will result in significant improvements to our system of controls that we believe will remediate the material weaknesses. However, material weaknesses are not considered remediated until the new controls have been operational for a period of time, are tested, and management concludes that these controls are operating effectively. This remediation process may require additional resources and will require time to implement. We will continue to monitor the effectiveness of these remediation measures, and we will make any changes to the design of our remediation plans and take such other actions that we deem appropriate given the circumstances.

Attestation Report of the Independent Registered Public Accounting Firm

The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by Deloitte & Touche LLP, an independent registered public accounting firm, which has expressed an adverse opinion, as stated in their report, which appears herein.

Changes in Internal Control over Financial Reporting

Other than the changes associated with the material weaknesses and remediation actions noted above, there have been no changes in our internal control over financial reporting during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.