Business First Bancshares Inc

Disclosure Controls and Procedures

Our management, including our principal executive officer and our principal financial officer, conducted an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of December 31, 2024. Our disclosure controls and procedures are designed to ensure that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our principal executive officer and our principal financial officer, to allow timely decisions regarding required disclosure. There are inherent limitations to the effectiveness of any system of disclosure controls and procedures. Accordingly, even effective disclosure controls and procedures can only provide reasonable assurance of achieving their control objectives. Based on their evaluation, our principal executive officer and our principal financial officer concluded that, as of the evaluation date, due to the material weakness in our internal control over financial reporting described below, our disclosure controls and procedures were not effective as of December 31, 2024.

However, after giving full consideration to the material weakness described below, management has concluded that the consolidated financial statements included in this Report present fairly, in all material respects, the Company’s financial position, the results of its operations and its cash flows for each of the periods presented in conformity with GAAP.

Management’s Annual Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting is a process designed under the supervision of our principal executive officer and our principal financial officer to provide reasonable assurance regarding the reliability of the financial reporting and preparation of our financial statements for external purposes in accordance with GAAP. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act.

The Company’s internal control over financial reporting includes those policies and procedures that: (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisitions, use, or disposition of the Company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2024, based on the criteria for effective internal control established in Internal Control– Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission in 2013. As permitted by SEC guidance, management excluded from its assessment the operations of Oakwood Bancshares, Inc. ("Oakwood"), which was acquired by us on October 1, 2024, and is described in "Note 3 - Mergers and Acquisitions" of the Notes to Consolidated Financial Statements included in Item 8 in this report. Oakwood represented 11.0% of our total assets as of December 31, 2024.

Based on the assessment, management determined that the Company’s internal control over financial reporting was not effective as of December 31, 2024 because of the material weakness described below. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

In January 2025, we identified control deficiencies involving the design and operation of information technology general controls (“ITGCs”) around change management segregation of duties with respect to certain information technology (“IT”) systems that support our financial reporting process, which we have outsourced to a third party service provider. Specifically, user access controls at our third party service provider lacked sufficient segregation of duties as multiple end users had the ability to both install changes into the production environment and develop application source code via permissions inherited through group membership. As a result, unauthorized changes could have gone undetected and could have had a direct or indirect impact on some of our financial reporting controls (both automated and manual) that relied on certain system reports. Through our own testing procedures, we determined no unauthorized changes occurred in the production database during the applicable periods. Nonetheless, we concluded that the deficiencies constituted a material weakness.

Forvis Mazars, LLP, an independent registered public accounting firm, has issued an unqualified opinion on our financial statements, which states that our consolidated financial statements present fairly, in all material respects, the financial position of the Company, the results of its operations and its cash flows for each of the periods presented in conformity with GAAP. The effectiveness of our internal control over financial reporting as of December 31, 2024 has also been audited by Forvis Mazars, LLP, an independent registered public accounting firm, as stated in their report which is included herein.

Management’s Remediation Plan

As noted above, during management’s assessment of internal control over financial reporting, a material weakness was identified related to the design and operation of ITGCs at our third party service provider. As management is responsible for maintaining effective internal control over financial reporting, and for the assessment of the effectiveness of internal control over financial reporting, we understand the importance of developing a remediation plan with our third party service provider that is aligned with management and overseen by the Audit Committee of our Board of Directors.

Management, with the oversight of the Audit Committee of our Board of Directors, is committed to maintaining a strong internal control environment, and has taken, and will continue to take, actions necessary to remediate the material weakness. The identified material weakness in our internal control over financial reporting will not be considered remediated until the remediated controls operate for a sufficient period of time and can be tested and concluded by management to be designed and operating effectively. Our remediation efforts include working with our third party service provider to ensure that it has taken steps to address its user access controls that led to the change management segregation of duties deficiencies. Accordingly, we cannot provide any assurance that our remediation efforts will be successful or that our internal control over financial reporting will be effective as a result of these efforts. As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify our remediation efforts. In addition, management will report the progress and status of our remediation efforts to the Audit Committee of our Board of Directors on a periodic basis.

Although unrelated to our remediation efforts, it is important to note that prior to the identification of the control deficiencies described above, we had notified our third party service provider of our intent to terminate our existing relationship with them effective as of May 2025, at which time we will transition the applicable services to a new third party service provider.

Changes in Internal Control over Financial Reporting

There were no significant changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the year ended December 31, 2024, that have materially affected or are reasonably likely to materially affect our internal control over financial reporting.